A Forensic Analysis of Android Malware -- How is Malware Written and How it Could Be Detected?

We consider in this paper the analysis of a large set of malware and benign applications from the Android ecosystem. Although a large body of research work has dealt with Android malware over the last years, none has addressed it from a forensic point of view. After collecting over 500,000 applicati...

Full description

Saved in:
Bibliographic Details
Main Authors: Allix, Kevin, Jerome, Quentin, Bissyande, Tegawende F., Klein, Jacques, State, Radu, Le Traon, Yves
Format: Conference Proceeding
Language:English
Subjects:
Android Security
Androids
Applications programs
Bioinformatics
Communities
Computer programs
Conferences
Construction
Digital Forensics
Forensic engineering
Genomics
Google
Humanoid robots
Malware
Malware Analysis
Malware development
Software
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:We consider in this paper the analysis of a large set of malware and benign applications from the Android ecosystem. Although a large body of research work has dealt with Android malware over the last years, none has addressed it from a forensic point of view. After collecting over 500,000 applications from user markets and research repositories, we perform an analysis that yields precious insights on the writing process of Android malware. This study also explores some strange artifacts in the datasets, and the divergent capabilities of state-of-the-art antivirus to recognize/define malware. We further highlight some major weak usage and misunderstanding of Android security by the criminal community and show some patterns in their operational flow. Finally, using insights from this analysis, we build a naive malware detection scheme that could complement existing anti virus software.
ISSN:0730-3157
DOI:10.1109/COMPSAC.2014.61