Android Malware Detection with Dynamic User Intention Based Analysis

資料洩漏在Android上愈來愈嚴重，隨著Android平台上惡意程式的滋長，保護使用者的資料變得愈來愈難。一個惡意程式再Android上很容易取得使用者的資料，所以對於想要偷資料的開發者而言，只要寫個Android上的程式就可以透過Android框架獲得使用者隱私資訊。對於使用者而言，他很難知道Android上的程式是否依照他的意願使用他的隱私資料。這篇論文提供另外一個自動偵測惡意程式的方法。我們透過動態分析觀察使用者和程式的互動情形來判斷受測程式是否為惡意程式。最後，我們分析使用我們的方法，在一般程式和惡意程式的集合裡面，分別可以有多少的準確度，以及這個方法本身的限制。Data leakage problem of Android apps is becoming more and more severe. Due to the enlarging Android ecology and the emerging of booming of various bytes of Android malwares, it is hard to keep user’s important data safe. For a malware, to steal important data from user is easy. The attacker can write an app and retrieve the user or device information from Android framework. Users with these apps installed is hard to know whether the application is using his or her data in an authorized way. In this paper, we provide a methodology to analyze out-going data with the observation of user-application interactions. With observation, we can get some information about the behavior of the app. Then we identify whether the app is benign or malicious by judging if an app is treating user’s data in a proper way. In brief, we want to tell if an app is treating user’s data in a right way by judging how the user interacts with the app. In the end, we show how this method performs by testing a numbers of applications, which are classified into two sets, normal set and malicious set respectively. With the evaluation of our method, we illustrate the performance of our system and its limitation.Acknowledgments ... i 中文摘要 ... ii Abstract ... iii 1 Introduction ... 1 1.1 Motivation ... 1 1.2 Thesis Organization ... 2 2 Background and Related Works ... 4 2.1 Android ... 4 2.1.1 Dalvik Virtual Machine ... 4 2.1.2 Interpreter ... 5 2.1.3 Activity and View ... 6 2.1.4 Java Native Interface (JNI) ... 7 2.1.5 Emulator ... 7 2.1.6 Adb ... 7 2.1.7 Android Monkey ... 8 2.2 Dynamic Analysis ... 8 2.3 TaintDroid ... 8 2.4 APE ... 9 2.5 Static User Intention Based Analysis ... 10 2.6 Related Work ... 11 3 Dynamic User Intention Based Analysis ... 12 3.1 Software Architecture ... 12 3.1.1 Input Capturer ... 12 3.1.2 Trigger Checker ... 13 3.1.3 User Trigger Taint ... 15 3.2 Automatic Testing ... 16 3.3 Analysis ... 17 4 Evaluation ... 19 4.1 Experimental Setup ... 19 4.2 Test Set ... 20 4.3 Test Flow ... 20 4.4 Profiling ... 20 4.4.1 Error in Massive Testing ... 21 4.4.2 Tag Distribution Matrix ... 21 4.4.3 Profiling Result ... 22 4.5 Well Triggered Set ... 23 4.5.1 Scoring ... 24 4.6 Accuracy ... 25 5 Conclusion and Future Work ... 27 5.1 Conclusion ... 27 5.2 Future Work ... 27 Bibliography ... 2