Article ID | Journal | Published Year | Pages | File Type |
---|---|---|---|---|
10341443 | Digital Investigation | 2016 | 13 Pages |
Abstract
Android's market experienced exponential popularity during the last few years. This blazing growth has, unfortunately, opened the door to thousands of malicious applications targeting Android devices everyday. Moreover, with the increasing sophistication of today's malware, the use of traditional hashing techniques for Android malware fingerprinting becomes defenseless against polymorphic malicious applications. Inspired by fuzzy hashing techniques, we propose, in this paper, a novel and comprehensive fingerprinting approach for Android packaging APK. The proposed fingerprint captures, not only the binary features of the APK file, but also the underlying structure of the app. Furthermore, we leverage this fingerprinting technique to build ROAR, an automatic system for Android malware detection and family attribution. Our experiments show that the proposed fingerprint and the ROAR system achieve a precision of 95%.
Related Topics
Physical Sciences and Engineering
Computer Science
Computer Networks and Communications
Authors
ElMouatez Billah Karbab, Mourad Debbabi, Djedjiga Mouheb,