Automatic Investigation Framework for Android Malware Cyber-Infrastructures
This addresses the problem of insufficient network-focused analysis for Android malware, which is crucial for security researchers and practitioners, though it appears incremental by building on existing graph theory techniques.
The authors tackled the limited coverage of network dimensions in Android malware analysis by developing ToGather, an automatic investigation framework that analyzes malware samples to produce situation awareness about malicious cyber infrastructures, with results described as interesting and promising based on experiments with real malware samples.
The popularity of Android system, not only in the handset devices but also in IoT devices, makes it a very attractive destination for malware. Indeed, malware is expanding at a similar rate targeting such devices that rely, in most cases, on Internet to work properly. The state-of-the-art malware mitigation solutions mainly focus on the detection of the actual malicious Android apps using dy- namic and static analyses features to distinguish malicious apps from benign ones. However, there is a small coverage for the In- ternet/network dimension of the Android malicious apps. In this paper, we present ToGather, an automatic investigation framework that takes the Android malware samples, as input, and produces a situation awareness about the malicious cyber infrastructure of these samples families. ToGather leverages the state-of-the-art graph theory techniques to generate an actionable and granular intelligence to mitigate the threat imposed by the malicious Internet activity of the Android malware apps. We experiment ToGather on real malware samples from various Android families, and the obtained results are interesting and very promising