AndroNeo: Hardening Android Malware Sandboxes by Predicting Evasion Heuristics - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2018

AndroNeo: Hardening Android Malware Sandboxes by Predicting Evasion Heuristics

Yonas Leguesse
  • Fonction : Auteur
  • PersonId : 1036538
Mark Vella
  • Fonction : Auteur
  • PersonId : 1036539
Joshua Ellul
  • Fonction : Auteur
  • PersonId : 1036540

Résumé

Sophisticated Android malware families often implement techniques aimed at avoiding detection. Split personality malware for example, behaves benignly when it detects that it is running on an analysis environment such as a malware sandbox, and maliciously when running on a real user’s device. These kind of techniques are problematic for malware analysts, often rendering them unable to detect or understand the malicious behaviour. This is where sandbox hardening comes into play. In our work, we exploit sandbox detecting heuristic prediction to predict and automatically generate bytecode patches, in order to disable the malware’s ability to detect a malware sandbox. Through the development of AndroNeo, we demonstrate the feasibility of our approach by showing that the heuristic prediction basis is a solid starting point to build upon, and demonstrating that when heuristic prediction is followed by bytecode patch generation, split personality can be defeated.
Fichier principal
Vignette du fichier
469589_1_En_9_Chapter.pdf (525.79 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01875520 , version 1 (17-09-2018)

Licence

Paternité

Identifiants

Citer

Yonas Leguesse, Mark Vella, Joshua Ellul. AndroNeo: Hardening Android Malware Sandboxes by Predicting Evasion Heuristics. 11th IFIP International Conference on Information Security Theory and Practice (WISTP), Sep 2017, Heraklion, Greece. pp.140-152, ⟨10.1007/978-3-319-93524-9_9⟩. ⟨hal-01875520⟩
219 Consultations
111 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More