Andro-AutoPsy: Anti-malware system based on similarity matching of malware and malware creator-centric information

•Our system leverages malware creator information for primary screening.•Our system is anti-malware system based on similarity matching of profiles.•Our profiling depicts the unique behavior pattern of malware•Our system is capable of detecting zero-day threats missed by antivirus scanners.

Mobile security threats have recently emerged because of the fast growth in mobile technologies and the essential role that mobile devices play in our daily lives. For that, and to particularly address threats associated with malware, various techniques are developed in the literature, including ones that utilize static, dynamic, on-device, off-device, and hybrid approaches for identifying, classifying, and defend against mobile threats. Those techniques fail at times, and succeed at other times, while creating a trade-off of performance and operation. In this paper, we contribute to the mobile security defense posture by introducing Andro-AutoPsy, an anti-malware system based on similarity matching of malware-centric and malware creator-centric information. Using Andro-AutoPsy, we detect and classify malware samples into similar subgroups by exploiting the profiles extracted from integrated footprints, which are implicitly equivalent to distinct characteristics. The experimental results demonstrate that Andro-AutoPsy is scalable, performs precisely in detecting and classifying malware with low false positives and false negatives, and is capable of identifying zero-day mobile malware.

Graphical abstractFigure optionsDownload full-size imageDownload as PowerPoint slide