By the analysis of vulnerabilities of Android native system services,we find that some vulnerabilities are caused by inconsistent data transmission and inconsistent data processing logic between client and server.The ...By the analysis of vulnerabilities of Android native system services,we find that some vulnerabilities are caused by inconsistent data transmission and inconsistent data processing logic between client and server.The existing research cannot find the above two types of vulnerabilities and the test cases of them face the problem of low coverage.In this paper,we propose an extraction method of test cases based on the native system services of the client and design a case construction method that supports multi-parameter mutation based on genetic algorithm and priority strategy.Based on the above method,we implement a detection tool-BArcherFuzzer to detect vulnerabilities of Android native system services.The experiment results show that BArcherFuzzer found four vulnerabilities of hundreds of exception messages,all of them were confirmed by Google and one was assigned a Common Vulnerabilities and Exposures(CVE)number(CVE-2020-0363).展开更多
The prevalence of smartphones is deeply embedded in modern society,impacting various aspects of our lives.Their versatility and functionalities have fundamentally changed how we communicate,work,seek entertainment,and...The prevalence of smartphones is deeply embedded in modern society,impacting various aspects of our lives.Their versatility and functionalities have fundamentally changed how we communicate,work,seek entertainment,and access information.Among the many smartphones available,those operating on the Android platform dominate,being the most widely used type.This widespread adoption of the Android OS has significantly contributed to increased malware attacks targeting the Android ecosystem in recent years.Therefore,there is an urgent need to develop new methods for detecting Android malware.The literature contains numerous works related to Android malware detection.As far as our understanding extends,we are the first ones to identify dangerous combinations of permissions and system calls to uncover malicious behavior in Android applications.We introduce a novel methodology that pairs permissions and system calls to distinguish between benign and malicious samples.This approach combines the advantages of static and dynamic analysis,offering a more comprehensive understanding of an application’s behavior.We establish covalent bonds between permissions and system calls to assess their combined impact.We introduce a novel technique to determine these pairs’Covalent Bond Strength Score.Each pair is assigned two scores,one for malicious behavior and another for benign behavior.These scores serve as the basis for classifying applications as benign or malicious.By correlating permissions with system calls,the study enables a detailed examination of how an app utilizes its requested permissions,aiding in differentiating legitimate and potentially harmful actions.This comprehensive analysis provides a robust framework for Android malware detection,marking a significant contribution to the field.The results of our experiments demonstrate a remarkable overall accuracy of 97.5%,surpassing various state-of-the-art detection techniques proposed in the current literature.展开更多
针对Android恶意软件经常被混淆以逃避检测的问题,提出基于敏感函数调用图(sensitive function call graphs,SFCG)表征学习的敏感函数调用图检测(sensitive function call graphs detector,SFCG_Detector)方法,用于检测Android恶意软件...针对Android恶意软件经常被混淆以逃避检测的问题,提出基于敏感函数调用图(sensitive function call graphs,SFCG)表征学习的敏感函数调用图检测(sensitive function call graphs detector,SFCG_Detector)方法,用于检测Android恶意软件。首先,通过静态分析提取函数调用图,并设计图修剪策略,保留与敏感应用程序接口(application programming interface,API)相关的关键节点,降低图的复杂性并保留行为语义。在节点表征方面,基于变换器的双向编码器表示(bidirectional encoder representation from transformers,BERT)模型与Katz中心性,提取节点的语义特征和结构重要性。随后,利用图采样与聚合(graph sample and aggregation,GraphSAGE)神经网络对敏感函数调用图进行层次化学习,生成图级嵌入以支持分类任务。使用经典的加拿大网络安全研究所恶意软件数据集2020版(Canadian institute for cybersecurity malware dataset 2020,CICMalDroid 2020)进行实验,结果表明,SFCG_Detector在恶意软件检测上的F1分数达到98.75%,召回率达到98.89%。相比其他方法,SFCG_Detector能有效地识别出Android恶意软件,性能上有明显提升。展开更多
基金This work was supported by the National Key R&D Program of China(2023YFB3106800)the National Natural Science Foundation of China(Grant No.62072051).We are overwhelmed in all humbleness and gratefulness to acknowledge my depth to all those who have helped me to put these ideas.
文摘By the analysis of vulnerabilities of Android native system services,we find that some vulnerabilities are caused by inconsistent data transmission and inconsistent data processing logic between client and server.The existing research cannot find the above two types of vulnerabilities and the test cases of them face the problem of low coverage.In this paper,we propose an extraction method of test cases based on the native system services of the client and design a case construction method that supports multi-parameter mutation based on genetic algorithm and priority strategy.Based on the above method,we implement a detection tool-BArcherFuzzer to detect vulnerabilities of Android native system services.The experiment results show that BArcherFuzzer found four vulnerabilities of hundreds of exception messages,all of them were confirmed by Google and one was assigned a Common Vulnerabilities and Exposures(CVE)number(CVE-2020-0363).
文摘The prevalence of smartphones is deeply embedded in modern society,impacting various aspects of our lives.Their versatility and functionalities have fundamentally changed how we communicate,work,seek entertainment,and access information.Among the many smartphones available,those operating on the Android platform dominate,being the most widely used type.This widespread adoption of the Android OS has significantly contributed to increased malware attacks targeting the Android ecosystem in recent years.Therefore,there is an urgent need to develop new methods for detecting Android malware.The literature contains numerous works related to Android malware detection.As far as our understanding extends,we are the first ones to identify dangerous combinations of permissions and system calls to uncover malicious behavior in Android applications.We introduce a novel methodology that pairs permissions and system calls to distinguish between benign and malicious samples.This approach combines the advantages of static and dynamic analysis,offering a more comprehensive understanding of an application’s behavior.We establish covalent bonds between permissions and system calls to assess their combined impact.We introduce a novel technique to determine these pairs’Covalent Bond Strength Score.Each pair is assigned two scores,one for malicious behavior and another for benign behavior.These scores serve as the basis for classifying applications as benign or malicious.By correlating permissions with system calls,the study enables a detailed examination of how an app utilizes its requested permissions,aiding in differentiating legitimate and potentially harmful actions.This comprehensive analysis provides a robust framework for Android malware detection,marking a significant contribution to the field.The results of our experiments demonstrate a remarkable overall accuracy of 97.5%,surpassing various state-of-the-art detection techniques proposed in the current literature.
文摘针对Android恶意软件经常被混淆以逃避检测的问题,提出基于敏感函数调用图(sensitive function call graphs,SFCG)表征学习的敏感函数调用图检测(sensitive function call graphs detector,SFCG_Detector)方法,用于检测Android恶意软件。首先,通过静态分析提取函数调用图,并设计图修剪策略,保留与敏感应用程序接口(application programming interface,API)相关的关键节点,降低图的复杂性并保留行为语义。在节点表征方面,基于变换器的双向编码器表示(bidirectional encoder representation from transformers,BERT)模型与Katz中心性,提取节点的语义特征和结构重要性。随后,利用图采样与聚合(graph sample and aggregation,GraphSAGE)神经网络对敏感函数调用图进行层次化学习,生成图级嵌入以支持分类任务。使用经典的加拿大网络安全研究所恶意软件数据集2020版(Canadian institute for cybersecurity malware dataset 2020,CICMalDroid 2020)进行实验,结果表明,SFCG_Detector在恶意软件检测上的F1分数达到98.75%,召回率达到98.89%。相比其他方法,SFCG_Detector能有效地识别出Android恶意软件,性能上有明显提升。
