- 期刊
- OpenAccess
DROIT: Dynamic Alternation of Dual-Level Tainting for Malware Analysis
並列摘要
Taint analysis for Android malware has received much attention in recent research. Existing taint techniques operate either at Java object level or at deeper instruction level. Object-level tracking is suitable for malware written in Java byte-code, but not for native ones. Instruction-level tracking captures the finest data flow. However, it leads to obscure semantic reconstruction and low performance. In this paper, we present DROIT, a taint tracker which dynamically alternates between object-level and instruction-level tracking on demands. DROIT tracks data flow at Java object level in general. When its Dalvik VM exits the byte-code execution, DROIT automatically switches to instructionlevel tracking, and vice versa. The trigger-based DROIT can alternate between the two levels in an efficient manner, and can provide dual-level whole image of the data flow, rather than fragments. Tracking at the dual levels also eases the semantic reconstruction significantly. The experiment with Android information-stealing trojans showed that DROIT can handle Java-based malware, those composed in native code, and those alternating between the two levels (e.g., DroidKungFu), respectively.
被引用紀錄
延伸閱讀
- Huang, L. C., Chang, C. H., & Hwang, M. S. (2020). Research on Malware Detection and Classification Based on Artificial Intelligence. International Journal of Network Security, 22(5), 717-727. https://doi.org/10.6633/IJNS.202009_22(5).01
- 林志鴻、楊中皇（2011）。Design and Implementation of Malware Collection Systems for Network Forensic Analysis。載於中華民國資訊安全學會（主編），全國資訊安全會議（頁191-198）。中華民國資訊安全學會。https://doi.org/10.29615/CISC.201105.0191
- HUANG, Y. T., CHEN, T. Y., HSIAO, S. W., & SUN, Y. S. (2022). Learning Dynamic Malware Representation From Common Behavior. Journal of Information Science and Engineering, 38(6), 1317-1334. https://doi.org/10.6688/JISE.202211_38(6).0012
- 彭建福（2011）。Using Aggregation Technology to Improve System Call Based Malware Behavior Detection〔碩士論文，國立中央大學〕。華藝線上圖書館。https://www.airitilibrary.com/Article/Detail?DocID=U0031-1903201314430091
- Lin, C. T., Wang, N. J., Xiao, H., & Eckert, C. (2015). Feature Selection and Extraction for Malware Classification. Journal of Information Science and Engineering, 31(3), 965-992. https://doi.org/10.6688/JISE.2015.31.3.11