An Empirical Study of Code Deobfuscations on Detecting Obfuscated Android Piggybacked Apps
- Publisher:
- IEEE
- Publication Type:
- Conference Proceeding
- Citation:
- 2020 27th Asia-Pacific Software Engineering Conference (APSEC), 2021, 2020-December, pp. 41-50
- Issue Date:
- 2021-03-01
Closed Access
| Filename | Description | Size | |||
|---|---|---|---|---|---|
| 09359260.pdf | Published Version | 518.04 kB |
Copyright Clearance Process
- Recently Added
- In Progress
- Closed Access
This item is closed access and not available.
Android piggybacked malware (i.e., apps that piggyback malicious code) are becoming ubiquitous in app stores. Malware writers often use obfuscation techniques to obfuscate piggybacked apps to evade detection by Android malware detectors. Previous studies in this field have focused on the impact of code obfuscations on the detection of piggybacked malware, but the impact of code deobfuscation on detecting obfuscated piggybacked apps has rarely been studied. Knowing about the impact of code deobfuscation can provide useful insights into obfuscated piggybacked apps and therefore the design of resilient Android malware detectors. In this paper we conduct an empirical study of code deobfuscations on detecting obfuscated Android piggybacked apps, focusing on three types of malware detectors: commercial anti-malware products, machine learning-based detectors, and similarity-based detectors. We observe that code deobfuscations can impact differently depending on the malware detectors. For example, some deobfuscation strategies can improve the precision of detecting obfuscated piggybacked apps. Also we observe that the examined deobfuscation tools (Simplify and Deguard) have a different impact on obfuscated piggybacked apps after deobfuscations.
Please use this identifier to cite or link to this item: