一种静态安卓应用混淆检测方法
A Static Android Application Obfuscation Detection Method
马腾 1徐建1
作者信息
- 1. 南京理工大学计算机科学与工程学院 南京 210094
- 折叠
摘要
混淆检测技术是安卓相似性检测、恶意软件检测以及第三方库检测的重要辅助手段.对于软件安全从业者来说,在进行逆向分析之前自动的混淆检测可以帮助逆向工程师更有效地开展逆向分析.论文研究并实现了一种新的方法,用来识别安卓应用程序是否被混淆,以及如果被混淆使用的是何种混淆工具.该方法仅依赖于安卓应用程序中的Dalvik字节码,识别问题被等效置换为一个基于字节码属性模型(例如不同类别字符串)的机器学习分类任务,通过分类模型从相对简单的代码特征中推断出精确的混淆来源信息.实验结果取得了0.94的F1分数,能对使用ProGuard、Allatori以及DashO进行混淆的APK进行准确分类.
Abstract
Obfuscation detection technology is an important auxiliary means for Android similarity detection,malware detec-tion and third-party library detection.For software security practitioners,automatic obfuscation detection before reverse analysis can help reverse engineers to perform reverse analysis more efficiently.This paper investigates and implements a new method to iden-tify whether an Android application is obfuscated,and if so,which obfuscation tool is used.The method relies only on the Dalvik by-tecode in the Android application,and the recognition problem is equivalently replaced by a machine learning classification task based on a model of bytecode attributes(such as strings of different categories),through the classification model from relatively sim-ple code,the precise source of confusion is inferred from the features.Experiments are carried out on the constructed obfuscated ap-plication dataset,and the results show that the method achieves an F1 score of 0.94 and can accurately classify the obfuscated APKs using ProGuard,Allatori and DashO.
关键词
混淆检测/安卓应用/恶意软件/静态分析/机器学习Key words
obfuscation detection/Android application/malicious software/static analysis/machine learning引用本文复制引用
出版年
2024
国家科技期刊平台
NSTL
万方数据