DySign: Dynamic fingerprinting for the automatic detection of android malware

El Mouatez Billah Karbab, Mourad Debbabi, Saed Alrabaee, Djedjiga Mouheb

Research output: Chapter in Book/Report/Conference proceedingConference contribution

20 Citations (Scopus)

Abstract

The astonishing spread of Android OS, not only in smart phones and tablets but also in IoT devices, makes this operating system a very tempting target for malware threats. Indeed, the latter are expanding at a similar rate. In this respect, malware fingerprints, whether based on cryptographic or fuzzyhashing, are the first defense line against such attacks. Fuzzyhashing fingerprints are suitable for capturing malware static features. Moreover, they are more resilient to small changes in the actual static content of malware files. On the other hand, dynamic analysis is another technique for malware detection that uses emulation environments to extract behavioral features of Android malware. However, to the best of our knowledge, there is no such fingerprinting technique that leverages dynamic analysis and would act as the first defense against Android malware attacks. In this paper, we address the following question: could we generate effective fingerprints for Android malware through dynamic analysis? To this end, we propose DySign, a novel technique for fingerprinting Android malware's dynamic behaviors. This is achieved through the generation of a digest from the dynamic analysis of a malware sample with respect to existing known malware. It is important to mention that: (i) DySign fingerprints are approximates of the observed behaviors during dynamic analysis so as to achieve resiliency to small changes in the behaviors of future malware variants; (ii) Fingerprint computation is agnostic to the analyzed malware sample or family. DySign leverages state-of-the-art Natural Language Processing (NLP) techniques to generate the aforementioned fingerprints, which are then leveraged to build an enhanced Android malware detection system with family attribution. The evaluation of the proposed system on both real-life malware and benign apps demonstrates a good detection performance with high scalability.

Original languageEnglish
Title of host publication2016 11th International Conference on Malicious and Unwanted Software, MALWARE 2016
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages139-146
Number of pages8
ISBN (Electronic)9781509045426
DOIs
Publication statusPublished - Mar 28 2017
Externally publishedYes
Event11th International Conference on Malicious and Unwanted Software, MALWARE 2016 - Fajardo, United States
Duration: Oct 18 2016Oct 21 2016

Publication series

Name2016 11th International Conference on Malicious and Unwanted Software, MALWARE 2016

Conference

Conference11th International Conference on Malicious and Unwanted Software, MALWARE 2016
Country/TerritoryUnited States
CityFajardo
Period10/18/1610/21/16

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Software
  • Safety, Risk, Reliability and Quality

Fingerprint

Dive into the research topics of 'DySign: Dynamic fingerprinting for the automatic detection of android malware'. Together they form a unique fingerprint.

Cite this