Researchers at Indiana University and Penn State University have announced a simple and fast method capable of detecting much of the malware used in zero-day attacks.
Their method is presented in the paper Finding Unknown Malice in 10 Seconds: Mass Vetting for New Threats at the Google-Play Scale[1]. I have not yet read it carefully myself, but from a quick look, it appears to detect malware by making use of the following observations:
- Most Android malware is repackaged existing malware => this can be identified by examining Java methods.
- It is suspicious when unrelated apps use the same methods, except for methods from well-known libraries.
In other words, to put it very roughly, the process seems to be:
- First, prepare a list of methods from well-known libraries (A).
- Extract the methods from each apk file in the Google Play Store (bi).
- For each i, calculate ci=bi＼A.
- For every i and j, check whether ci ∩cj≠∅.
It seems that this is how the check is performed. If ci ∩cj≠∅, the apps are considered suspicious.
This approach seems likely to produce a great many false positives, but apparently it does not produce that many in practice. In addition, code used for zero-day attacks tends to spread through multiple apps, so this method is reportedly able to detect such code as well.
Under the Google Play Store’s current review system, even when a piece of malware is excluded, only the developer is excluded. As a result, the same code is sometimes submitted by another applicant and passes review. Incorporating a mechanism like this into the review process therefore seems likely to be extremely useful.
I have not had enough time lately to write about this in detail, but if you are interested, why not read the original paper?
[1] Chen, K., et al: Finding Unknown Malice in 10 Seconds: Mass Vetting for New Threats at the Google-Play Scale, Indiana University (2015/8/31) http://www.informatics.indiana.edu/xw7/papers/vetfast.pdf
Related posts
I Will Appear on the Okinawa Open Days Panel “Current and Future OSS Initiatives in Economic Security”
It is already the day of the event—in fact, I am writing this now (12/4 9:45) at my desk while preparing for the panel—but I will…
The “DS-511 Guidelines for Handling Digital Identity in Identity Verification for Administrative Procedures, etc.” Have Been Published
After 3 years of development, the Digital Identity Guidelines, to which I had the privilege of contributing as an expert (Expert Meeting on the Revision of…
Age Verification: The UK Online Safety Act Is Being Toyed With in All Kinds of Ways—Bypassing It With VPNs and Evading Biometrics With Death Stranding
What Is the UK's Online Safety Act? The UK's Online Safety Act formally became law after receiving Royal Assent on October 26, 2023, and came into…