HomDroid：通过社交网络同质性分析检测Android隐蔽恶意软件
HomDroid: Detecting Android Covert Malware by Social-Network Homophily Analysis
摘要：
Android已经成为最流行的移动操作系统。与此相对应，越来越多的Android恶意软件被开发和传播，以窃取用户的私人信息。存在一种类型的恶意软件，其良性行为被开发来伪装恶意行为。恶意组件只占应用程序（简称app）整个代码的一小部分，并且恶意部分与良性部分强耦合。在这种情况下，当恶意软件检测器从整个应用程序中提取特征以进行分类时，恶意软件可能导致误报，因为这些应用程序的恶意特征可能隐藏在良性特征中。此外，以前的一些工作旨在将整个应用程序划分为几个部分以发现恶意部分。然而，这些方法开始应用程序分区的前提是正常部分和恶意部分之间的连接是弱的。在本文中，我们将这种类型的恶意软件称为Android隐蔽恶意软件，并生成隐蔽恶意软件的第一个数据集。为了检测它们，我们首先进行静态分析以提取调用图。通过对图的深入分析，我们发现虽然这些图中正常部分和恶意部分之间的相关性很高，但这些相关性的程度具有分布性。在此基础上，我们设计了HomDroid，通过分析调用图的同质性来检测隐藏的恶意软件。我们根据4，840个良性应用程序和3，385个隐蔽恶意应用程序的数据集的评估结果确定了区分正常部分和恶意部分的理想相关性阈值。根据我们的评估结果，HomDroid能够检测96.8%的隐蔽恶意软件，而另外四个最先进的系统（即，PerDroid、Drebin、MaMaDroid和IntDroid）分别为30.7%、16.3%、15.2%和10.4%。
英文摘要：
Android has become the most popular mobile operating system. Correspondingly, an increasing number of Android malware has been developed and spread to steal users' private information. There exists one type of malware whose benign behaviors are developed to camouflage malicious behaviors. The malicious component occupies a small part of the entire code of the application (app for short), and the malicious part is strongly coupled with the benign part. In this case, the malware may cause false negatives when malware detectors extract features from the entire apps to conduct classification because the malicious features of these apps may be hidden among benign features. Moreover, some previous work aims to divide the entire app into several parts to discover the malicious part. However, the premise of these methods to commence app partition is that the connections between the normal part and the malicious part are weak. In this paper, we call this type of malware as Android covert malware and generate the first dataset of covert malware. To detect them, we first conduct static analysis to extract the call graphs. Through the deep analysis on graphs, we observe that although the correlations between the normal part and the malicious part in these graphs are high, the degree of these correlations has a distribution. Based on the observation, we design HomDroid to detect covert malware by analyzing the homophily of call graphs. We identify the ideal threshold of correlation to distinguish the normal part and the malicious part based on the evaluation results on a dataset of 4,840 benign apps and 3,385 covert malicious apps. According to our evaluation results, HomDroid is capable of detecting 96.8% of covert malware while the False Negative Rates of another four state-of-the-art systems (i.e., PerDroid, Drebin, MaMaDroid, and IntDroid) are 30.7%, 16.3%, 15.2%, and 10.4%, respectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
