App fingerprints can be used to verify whether two apps are the same, and are useful tools for malware detection because they can allow to recognize obfuscated versions of known malware. Fingerprinting an app on the base of static features is known to fail against obfuscation, as it is successful in hiding the static characteristics that reveal the malicious nature of an app. In this paper we propose a novel way to compute app fingerprints, which is based on behavioral features. The aim is to capture the semantics of the app, so that obfuscation results ineffective. The technique we introduce exploits invariants, found among pairs of metrics, collected during app execution, and produces a fingerprint consisting of the list of the correlation values of these pairs. We present an experimental evaluation carried out on a real Android device, whose obtained results support the methodology we propose, and show it can be a viable research direction to investigate further.

Towards the usage of invariant-based app behavioral fingerprinting for the detection of obfuscated versions of known malware / Shehu, Zigrid; Ciccotelli, Caludio; Ucci, Daniele; Aniello, Leonardo; Baldoni, Roberto. - STAMPA. - (2016), pp. 121-126. (Intervento presentato al convegno 10th International Conference on Next Generation Mobile Applications, Security and Technologies, NGMAST 2016 tenutosi a Cardiff, Wales; United Kingdom nel 24-26 August 2016) [10.1109/NGMAST.2016.16].

Towards the usage of invariant-based app behavioral fingerprinting for the detection of obfuscated versions of known malware

CICCOTELLI , CALUDIO;UCCI, DANIELE;ANIELLO, LEONARDO;BALDONI, Roberto
2016

Abstract

App fingerprints can be used to verify whether two apps are the same, and are useful tools for malware detection because they can allow to recognize obfuscated versions of known malware. Fingerprinting an app on the base of static features is known to fail against obfuscation, as it is successful in hiding the static characteristics that reveal the malicious nature of an app. In this paper we propose a novel way to compute app fingerprints, which is based on behavioral features. The aim is to capture the semantics of the app, so that obfuscation results ineffective. The technique we introduce exploits invariants, found among pairs of metrics, collected during app execution, and produces a fingerprint consisting of the list of the correlation values of these pairs. We present an experimental evaluation carried out on a real Android device, whose obtained results support the methodology we propose, and show it can be a viable research direction to investigate further.
2016
10th International Conference on Next Generation Mobile Applications, Security and Technologies, NGMAST 2016
android malware detection; app fingerprinting; invariant-based fingerprint; Computer Networks and Communications
04 Pubblicazione in atti di convegno::04b Atto di convegno in volume
Towards the usage of invariant-based app behavioral fingerprinting for the detection of obfuscated versions of known malware / Shehu, Zigrid; Ciccotelli, Caludio; Ucci, Daniele; Aniello, Leonardo; Baldoni, Roberto. - STAMPA. - (2016), pp. 121-126. (Intervento presentato al convegno 10th International Conference on Next Generation Mobile Applications, Security and Technologies, NGMAST 2016 tenutosi a Cardiff, Wales; United Kingdom nel 24-26 August 2016) [10.1109/NGMAST.2016.16].
File allegati a questo prodotto
File Dimensione Formato  
Shehu_Towards-the-Usage_2015.pdf

solo gestori archivio

Tipologia: Versione editoriale (versione pubblicata con il layout dell'editore)
Licenza: Tutti i diritti riservati (All rights reserved)
Dimensione 224.74 kB
Formato Adobe PDF
224.74 kB Adobe PDF   Contatta l'autore

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11573/933398
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 7
  • ???jsp.display-item.citation.isi??? 3
social impact