分析與實現規避 Android 模擬器檢測之研究

隨著行動裝置的普遍化，新的行動軟體的數量增加的速度越來越快，惡意行動軟體更是顯著的增加。為了遏止惡意行動軟體汙染了行動運算環境，許多的努力用於發展有效的惡意行動軟體的分析技術，其中需要根據行動軟體的行為表現來判定一個行動軟體是否為惡意軟的分析技術，需要將軟體置於模擬器中執行以進行行為資訊蒐集，然而惡意行動軟體也日趨精細，具備躲避技術的惡意軟體採用各種方法偵測執行環境是真實行動裝置或是模擬器，妨礙惡意軟體分析工具判斷行動軟體是否具有惡意的能力。因此，我們依據既有及未來可能出現的躲避偵測技術的特性，提出模擬器的改善作法，提高模擬器承受惡意軟體躲避技術的能力。基於Android為最普遍的行動裝置系統平台，我們實作所提出的改善作法於公開源碼的Android模擬器上，作為驗證所提出的改善作法有效性的平台。我們也設計了對應的使用者介面，協助使用者自動化完成模擬器環境設定。對於既有的躲避偵測技術，我們採用捕捉到的惡意行動軟體驗證改善作法有效性，對於目前尚未觀察到但是來可能出現的躲避偵測技術，我們製作對應的行動軟體並比較在真實裝置、模擬器及改善後的模擬器上執行的狀況以驗證有效性。測試的結果顯示，完成改善的模擬器可以更完善的協助惡意行動軟體分析。

關鍵字

Android ；惡意行動軟體；沙箱偵測；模擬器躲避

並列摘要

In recent years, usage of mobile devices has become prevalent. With more and more mobile applications published each year, the amount of mobile malwares also increases significantly. In order to prevent mobile malwares from polluting the mobile computing environment, a lot of effort has been spent to create effective mobile malware analysis techniques. Techniques relying on collecting behavioral information of mobile apps to perform corresponding analysis involve executing mobile apps in emulators to obtain the necessary information. Unfortunately, sophisticated malwares implement evasion techniques to discover whether the execution environment is a real mobile device or an emulator and hinder the ability of malware analysis tools to correctly determine whether a given mobile app is malicious or not. In this thesis, we propose enhancements on emulators to improve the resilience of malware analysis tools against evasion techniques based on the characteristics of exiting or potential mobile malware evasion techniques. With Android being the most popular mobile platform, the proposed enhancements are implemented and integrated into an open source Android emulator to facilitate the verification of the effectiveness of the enhancements. A user interface was also designed to assist the automated configuration of the enhanced emulator. Experiments were conducted using sample mobile malwares utilizing existing evasion techniques as well as specially crafted mobile apps for testing potential invasion techniques. The results show that, by incorporating the proposed enhancements, the emulator is better equipped in assisting mobile malware analysis.

並列關鍵字

Android ； Mobile Malware ； Sandbox Detection ； Emulator Evasion

參考文獻

[4] Enck, William, et al. “Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones.” ACM Transactions on Computer Systems (TOCS) 32.2 (2014): 5.

[9] Petsas, Thanasis, et al. "Rage against the virtual machine: hindering dynamic analysis of android malware." Proceedings of the Seventh European Workshop on System Security. ACM, 2014. p. 5.

[21] Rob Thomas and Jerry Martin. “The underground economy: Priceless.” USENIX; login, 31(6):7–16, 2006

[25] Aung, Zarni, and Win Zaw. "Permission-based android malware detection." International Journal of Scientific and Technology Research 2.3 (2013): 228-234.

Reference

Google Scholar

國際替代計量

分析與實現規避 Android 模擬器檢測之研究

全文下載

主題瀏覽