AppBeach: A Static Behavior Checker for iOS Mobile Applications

Fang Yu ； Steven Tai ； Tang-Wei Shao ； Wei-Ren Wang

《資訊安全通訊》 21卷2期 (2015/04) Pp. 41-51

並列摘要

AppBeach standing on App Behavior Checker is a new service to reconstruct and report behaviors of iOS mobile applications, using static binary analysis to reveal embedded functions within the executables. AppBeach adopts a distributed algorithm on call sequence counting via the hadoop framework, achieving a scalable static syntax analysis on executables of modern apps. The main idea is syntactically counting call sequences that are embedded in iOS executable. This is done by distributing routines to mappers with the assembly tool that resolves explicit and implicit system method calls that are embedded in the iOS executables. The reducer then collects the counting from mappers to characterize the behaviors of apps. We learn patterns of malicious behaviors from the difference of pairs of normal and malicious apps, and report the probability of potential behaviors of commercial apps by matching these patterns to their call sequence counts.

參考文獻

IDA Pro, https://www.hex-rays.com/products/ida.

AppBeach, http://soslab.nccu.edu.tw/appbeach, 2014

Find and Call, http://www.wired.com/2012/07/first-ios-malware-found, 2012.

Path, http://www.wired.com/2012/02/path-social-media-app-uploads-ios-address-booksto-its-servers/, 2012.

Babi´c, D.,Reynaud, D.,Song, D.(2011).Malware analysis with tree automata inference.Proceedings of the 23rd International Conference on Computer Aided Verification, CAV'11.(Proceedings of the 23rd International Conference on Computer Aided Verification, CAV'11).