DroidMorph: Are We Ready to Stop the Attack of Android Malware Clones?

According to the recent Symantec threat reports, Android continues to be the most targeted mobile platform, the number of new mobile malware attacks grew by 105% from 2015 to 2016 [1], and the number of new discovered mobile malware variants (clones) grew by 54% from 2016 to 2017 [2]. In addition to these simple attacks of clones, there are also Android malware clones of clones, i.e., clones of a malware family which themselves are clones. For example, DroidKungFu1, DroidKungFu2, DroidKungFu3 and DroidKungFu4 are 4 different families of the original Android DroidKungFu malware, and each of these 4 families have their own clones (variants) [3]. According to the McaFee threat report, the number of malware families found in the Google play increased by 30% in 2017 [4].

Malware writers use stealthy mutations (morphing/obfuscations) to continuously develop malware clones, thwarting detection by signature based detectors. This attack of clones seriously threatens all the mobile platforms, especially Android. In the rest of the paper we use variants and clones interchangeably.

As mentioned before, the number of Android malware clones are on the rise and, to stop this attack we need to develop new methods and techniques for analysing and detecting them. As a first step, we need to study how these malware clones are generated. This will help us better anticipate and recognize these clones. This is the main motivation for the research carried out in this paper.

In this paper, we present the design and development of an Android APK morphing tool, and using this tool evaluate resilience of the current commercial antimalware products against attack of the Android malware clones. This work also complements other such previous works [5, 6, 7, 8].

The contributions of this work are as follows:

• •

  Designing and developing of a morphing tool named DroidMorph, that provides morphing of Android applications (APKs) at different level of abstractions, and can be used to create Android application (malware/benign) clones.

• •

  Testing and evaluating resilience of current commercial antimalware products against attack of the Android malware clones generated by DroidMorph. We found that 8 out of 17 leading commercial anti-malware programs were not able to detect any of the morphed APKs.

The remainder of this paper is organized as follows. We present related work in Section II. A brief overview of DroidMorph is presented in Section III. Section IV presents the evaluation of DroidMorph by testing current commercial antimalware products against attack of the Android malware clones generated by DroidMorph. Section V finally concludes the paper.

In this Section, we briefly compare four of the previous works that have evaluated the resilience of commercial antimalware products with DroidMorph.

Faruki et al. [5] evaluated anti malware products against control, data and layout transformations. Anti-malware malware programs were then evaluated against different permutations of these three transformations. They found that top rated anti-malware programs are vulnerable against permutation of these transformations.

Rastogi et al. [6] evaluated anti malware products against a combination of trivial and non-trivial obfuscations. They tested 10 anti-malware programs. Repetitive transformations were used to fail the anti-malware program.

Zheng et al. [7] evaluated anti malware products against some of the non-trivial obfuscations. They collected 222 Android malware samples from the wild. These samples were then transformed to test them on VirusTotal [9] against different anti-malware programs. They reported that one of the anti-malware program tested (AntiY AVL) is better than the others.

Protsenko et al. [8] evaluated anti malware products against data and object-oriented design obfuscations. They tested 10 popular anti-malware programs and found deficiencies in most of them. They also compared and presented the shortcomings of a state of the art static similarity tool.

All these four works have implemented prototype tools to create variants (morph) of known malware to test and evaluate commercial antimalware products. Here are some of the differences between DroidMorph and the other four works.

• •

  DroidMorph is implemented on top of the Soot Framework [10], whereas [5, 6, 7] use third party tools for assembling and disassembling, and another set of tools for morphing. This dependency on a set of third party tools may make their [5, 6, 7] implementation unstable and inflexible, and incompatible to work with different Android OS APKs. Soot provides all necessary functionality regarding analysis, modification, and generation of Android/Java bytecode and is compatible with different Android OS APKs.

• •

  Unlike [8], DroidMorph provides direct support for analysis, modification, and generation of Android (Dalvik) bytecode.

• •

  Beside providing non-trivial and trivial obfuscations DroidMorph also provides morphing of Android APK at different level of abstractions.

Figure 1 provides a high level architectural overview of DroidMorph. We first decompile an Android APK to an intermediate form. Morphing is carried out at different level of abstractions on this intermediate form. The morphed intermediate form is then compiled to morphed Android APK. This APK is then signed to generate the final morphed and signed Android APK that is ready to run on the Android platform.

Current design of DroidMorph implements morphing at three level of abstractions, Class, Method and Body. The implementation of trivial and non-trivial obfuscations is work in progress. So far as trivial obfuscations, we have implemented morphing of Class and Method names, and as non-trivial obfuscations, we have implemented morphing of Control Flow Graph and Call Flow Graph.

We carried out an empirical study to analyse the correctness and efficiency of DroidMorph. We present in this section the empirical study, obtained results and analysis.

The number of Android malware clones are on the rise and to stop this attack of clones we need to study how these clones are generated. As a first step, in this paper we have presented a new tool named DroidMorph, that provides morphing of Android applications (APKs) at different level of abstractions. We used DroidMorph to generate Android malware clones to evaluate commercial anti-malware products and found that 8 out of 17 leading commercial anti-malware programs were not able to detect morphed APKs successfully. We hope that DroidMorph will be used in future research, to improve Android malware clones analysis and detection, and help stop them.

In DroidMorph, we have only implemented some basic trivial and non-trivial obfuscations (morphing). Implementation of other obfuscations is work in progress, which will further improve (reduce detection by anti-malware programs) the results. In future, we will further improve morphing at different levels, specifically class level morphing. We will also add morphing of meta information (permissions etc.) embedded in an APK which will further reduce the detection by anti-malware programs.