Journal
JOURNAL OF SYSTEMS ARCHITECTURE
Volume 125, Issue -, Pages -Publisher
ELSEVIER
DOI: 10.1016/j.sysarc.2022.102452
Keywords
Android; Dynamic analysis; Malware detection
Funding
- Natural Sciences and Engineering Research Council of Canada (NSERC)
- Canada Research Chairs (CRC) program
Ask authors/readers for more resources
CamoDroid is a dynamic analysis environment that fights against modern evasive Android malware detection, providing comprehensive monitoring and recording of application behavior, successfully cloaking its existence and being effective against over 96% of evasive Android malware.
In the past few years, numerous attempts have been made to mitigate evasive Android malware. However, it remains one of the challenges in smartphone security. Evasive malware can dodge dynamic analysis by detecting execution in sandboxes and hiding its malicious behaviors during the investigation. In this work, we present CamoDroid, an open-source and extendable dynamic analysis environment resilient against detection by state-of-the-art evasive Android malware. Our technique mimics data, sensors, user input, static and network features of actual devices and cloaks the existence of the analysis environment. It further improves dynamic analysis and provides a broad view of an application's behavior by monitoring and logging the dangerous Application Programming Interface (API) calls executed by applications. We implement CamoDroid and assess its resiliency to sandbox detection. We first demonstrate that our sandbox cannot be detected using modern existing academic and commercial applications that can distinguish analysis environments from real devices. We also assess the dependability of CamoDroid against real-world evasive malware and show that it can successfully cloak the existence of the analysis environment to more than 96 percent of evasive Android malware. Moreover, we investigate other popular Android sandboxes and show that they are vulnerable to at least one type of sandbox detection heuristic.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available