Andro-Dumpsys: Anti-malware system based on the similarity of malware creator and malware centric information
- Authors
- Jang, Jae-wook; Kang, Hyunjae; Woo, Jiyoung; Mohaisen, Aziz; Kim, Huy Kang
- Issue Date
- 5월-2016
- Publisher
- ELSEVIER ADVANCED TECHNOLOGY
- Keywords
- Volatile memory acquisition; Similarity; Malware creator centric information; Mobile malware; Android
- Citation
- COMPUTERS & SECURITY, v.58, pp.125 - 138
- Indexed
- SCIE
SCOPUS
- Journal Title
- COMPUTERS & SECURITY
- Volume
- 58
- Start Page
- 125
- End Page
- 138
- URI
- https://scholar.korea.ac.kr/handle/2021.sw.korea/88832
- DOI
- 10.1016/j.cose.2015.12.005
- ISSN
- 0167-4048
- Abstract
- With the fast growth in mobile technologies and the accompanied rise of the integration of such technologies into our everyday life, mobile security is viewed as one of the most prominent areas and is being addressed accordingly. For that, and especially to address the threat associated with malware, various malware-centric analysis methods are developed in the literature to identify, classify, and defend against mobile threats and malicious actors. However, along with this development, anti-malware analysis techniques, such as packing, dynamic loading, and dex encryption, have seen wide adoption, making existing malware-centric analysis methods less effective. In this paper, we propose a feature-rich hybrid anti-malware system, called Andro-Dumpsys, which leverages volatile memory acquisition for accurate malware detection and classification. Andro-Dumpsys is based on similarity matching of malware creator-centric and malware-centric information. Using Andro-Dumpsys, we detect and classify malware samples into similar behavior groups by exploiting their footprints, which are equivalent to unique behavior characteristics. Our experimental results demonstrate that Andro-Dumpsys is scalable, and performs well in detecting malware and classifying malware families with low false positives and false negatives, and is capable of responding zero-day threats. (C) 2016 Elsevier Ltd. All rights reserved.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - School of Cyber Security > Department of Information Security > 1. Journal Articles
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.