Publication: A critique of android malware classification systems
Loading...
Identifiers
Publication date
2023-08-14
Defense date
2022-02-14
Authors
Advisors
Journal Title
Journal ISSN
Volume Title
Publisher
Impact
Export
Abstract
Dado que Android lidera el mercado global de los sistemas operativos de móviles y
también los de malware (software malicioso) de móviles, la automatización de los procesos
de detección de malware se ha convertido en una necesidad. Del mismo modo, la
clasificación de familias de malware requiere también de un procesado automático debido
a la gran cantidad de muestras de malware que se detectan diariamente. A pesar de ello,
el estudio de la clasificación de familias de malware en Android no ha recibido suficiente
atención por parte de la comunidad científica. En esta tesis, nuestro objetivo es abordar
distintos problemas relacionados con el área de clasificación de familias de malware en
Android. Primero, realizamos un análisis global del diseño de sistemas de clasificación
de familias de malware en Android. Para ello se define claramente las Aplicaciones Potencialmente
Dañinas (PHA), Aplicaciones Potencialmente No-Deseadas (PUA) y las distintas
formas de malware, y comparamos el concepto de familia de malware al concepto
de comportamiento de malware en el ecosistema de Android. También estudiamos los
cambios en la política de publicación de aplicaciones de Google a lo largo de los años
y su impacto en estas definiciones. Además, estudiamos los fenómenos de PHA y PUA
tanto en el mercado oficial desde el punto de vista de Google como fuera de él desde los
puntos de vista de ambos, Google y la industria de Antivirus (AV) entre 2014 y 2018.
Complementamos nuestro estudio con un análisis global sobre como deberían ser realmente
los sistemas de clasificación de familias de malware de Android. En esta tarea,
examinamos cada componente de la arquitectura de análisis, describimos los factores que
les afectan y las limitaciones que pueden introducir en el diseño del sistema. Para entender
cómo se usa cada componente, estudiamos la literatura para identificar los sistemas de
clasificación existentes y discutimos las posibles limitaciones y los métodos para mejorar
estos sistemas o cualquier sistema con objetivos similares. A continuación estudiamos el
problema del etiquetado de malware tanto en el ámbito académico como en la industria.
Comenzamos con un análisis de las publicaciones (81) que utilizan etiquetas de malware
en los mejores congresos de seguridad informática (2011-2020) y hacemos lo mismo con
los informes (24) de la industria (2012-2020). Esto nos permite saber cuáles áreas de invectigación
dependen de los sistemas de clasificación de familias para lograr su objetivo.
Con objeto de analizar la calidad de este proceso, analizamos una dataset de etiquetas
de 2,5 milliones de aplicaciones e identificamos las inconsistencias de etiquetado entre
distintos programas AV. Este análisis nos permite explorar coincidencias y divergencias
entre dichos programas en cuanto a la familia de cada muestra. La falta de consenso es un
factor clave en la introducción de ruido a los sistemas de clasificación que dependen de
herramientas de unificación de etiquetas que usan voto mayoritario. Basándonos en nuestros
resultados, recomendamos distintas acciones en relación con el diseño de conjuntos
de muestras que ayuden en la reducción de ruido y sesgos. Finalmente, comparamos los
estudios llevados a cabo en esta tesis con trabajos recientes en el mismo área.
With Android being the market leader of mobile operating systems, as well as mobile malware, automating the pipeline of malware detection became a necessity. In a similar fashion, malware family classification requires automation due to the large amount of malware samples that are detected on a daily basis. However, malware family classification in Android is a less explored area by the scientific community. The key goal of this dissertation is to address several concerns about the Android malware family classification problem. We first carry out a comprehensive analysis of the design of Android malware family classification systems. To do so, we focus on clearly defining Potentially Harmful Apps (PHA), Potentially Unwanted Apps (PUA) and malware forms in addition to comparing the concept of malware family to that of malware behavior in the Android ecosystem. We also study Google’s policy changes over the years and how they impact these definitions. Besides, we study the PHA and PUA phenomena from the perspective of Google inside the official store (Play Store) as well as both Google’s and the AntiVirus (AV) industry’s view of these phenomena in the wild between 2014 and 2018. Our study is complemented with an overall view of how malware family classification systems in the Android context shall look like. We thoroughly look at each of the components and discuss the factors that affect it and the limitations that these factors might introduce in the system design. To understand how each component is applied and used, we survey published works and analyze existing classification systems. We discuss the possible limitations and means of improvement for these systems or any would-be system that is based on them. We subsequently investigate the problem of malware labeling in both academia and industry. We look into research papers from top computer security conferences between 2011 and 2020 (81 papers) and do the same with regards to industry reports between 2012 and 2020 (28 reports). Additionally, we study how each of these two relies on family classification systems to reach its objectives. Furthermore, we analyze the labels of a dataset of 2.5 million app hashes and identify the labeling inconsistencies between different AV Engines. This analysis helps demonstrate the extremely limited agreement between those engines. The lack of consensus is an important factor in introducing noise into classification systems that rely on label unification tools that use majority voting. Based on these findings, we recommend a series of actions with regards to dataset design as a means to reduce biases and noise in the set of samples. Finally, we compare the studies carried out in this thesis to recent work in the same area.
With Android being the market leader of mobile operating systems, as well as mobile malware, automating the pipeline of malware detection became a necessity. In a similar fashion, malware family classification requires automation due to the large amount of malware samples that are detected on a daily basis. However, malware family classification in Android is a less explored area by the scientific community. The key goal of this dissertation is to address several concerns about the Android malware family classification problem. We first carry out a comprehensive analysis of the design of Android malware family classification systems. To do so, we focus on clearly defining Potentially Harmful Apps (PHA), Potentially Unwanted Apps (PUA) and malware forms in addition to comparing the concept of malware family to that of malware behavior in the Android ecosystem. We also study Google’s policy changes over the years and how they impact these definitions. Besides, we study the PHA and PUA phenomena from the perspective of Google inside the official store (Play Store) as well as both Google’s and the AntiVirus (AV) industry’s view of these phenomena in the wild between 2014 and 2018. Our study is complemented with an overall view of how malware family classification systems in the Android context shall look like. We thoroughly look at each of the components and discuss the factors that affect it and the limitations that these factors might introduce in the system design. To understand how each component is applied and used, we survey published works and analyze existing classification systems. We discuss the possible limitations and means of improvement for these systems or any would-be system that is based on them. We subsequently investigate the problem of malware labeling in both academia and industry. We look into research papers from top computer security conferences between 2011 and 2020 (81 papers) and do the same with regards to industry reports between 2012 and 2020 (28 reports). Additionally, we study how each of these two relies on family classification systems to reach its objectives. Furthermore, we analyze the labels of a dataset of 2.5 million app hashes and identify the labeling inconsistencies between different AV Engines. This analysis helps demonstrate the extremely limited agreement between those engines. The lack of consensus is an important factor in introducing noise into classification systems that rely on label unification tools that use majority voting. Based on these findings, we recommend a series of actions with regards to dataset design as a means to reduce biases and noise in the set of samples. Finally, we compare the studies carried out in this thesis to recent work in the same area.
Description
Mención Internacional en el título de doctor
Keywords
Android malware family classification, Antivirus, Clustering, Labels, Potentially harmful apps, PHA, Potentially unwanted apps, PUA