文件名称：ANDROID MALWARE
文件大小：3.46MB
文件格式：PDF
更新时间：2017-06-14 04:48:10
ANDROID安全
This book is based on our years-long research conducted to systematically analyze emerging Android malware. Some of our earlier research results and findings were reported in an IEEE conference paper entitled Dissecting Android Malware: Characterization and Evolution, which was presented at the IEEE Symposium on Security and Privacy (often mentioned as Oakland conference in the security community) in May, 2012 [77]. During and after the conference, we were pleased to receive and hear inquiries from colleagues with encouraging comments on the systematization of knowledge work that has been conducted in our conference paper. Partially because of that, we are motivated to expand our work and hope such efforts will be of service to the security and privacy community. Further, as part of that, we have released corresponding malware dataset for our study under the name Android Malware Genome Projectto the community. With that, we want to take this opportunity to thank our collaborators, Dongyan Xu, Peng Ning, Xinyuan Wang, Shihong Zou, and others, whose valuable insights and comments greatly enriched our work. The authors are also grateful to colleagues in the Cyber Defense Lab at NC State University, especially Tyler Bletsch, Zhi Wang, Michael Grace, Deepa Srinivasan, Minh Q. Tran, Chiachih Wu, Wu Zhou, and Kunal Patel. Special thanks also go to Susan Lagerstrom-Fife and our publisher for their great help and patience! This research was supported in part by the US National Science Foundation (NSF) under Grants 0855297, 0855036, 0910767, and 0952640. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, for the NSF. 1 Introduction ........................................ 1 2 A Survey of Android Malware........................... 3 2.1 Malware Dataset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.2 Malware Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.2.1 Malware Installation . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.2.2 Activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.2.3 Malicious Payloads . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.2.4 Permission Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 3 Case Studies ........................................ 21 3.1 Malware I: Plankton . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 3.1.1 Phoning Home . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 3.1.2 Dynamic Execution . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 3.2 Malware II: DroidKungFu . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 3.2.1 Root Exploits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 3.2.2 Command and Control (C&C) Servers . . . . . . . . . . . . . 24 3.2.3 Payloads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 3.2.4 Obfuscation, JNI, and Others . . . . . . . . . . . . . . . . . . . . 26 3.3 Malware III: AnserverBot. . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 3.3.1 Anti-Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 3.3.2 Command and Control (C&C) Servers . . . . . . . . . . . . . 28 4 Discussion.......................................... 31 5 Additional Reading................................... 33 5.1 Books . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 5.1.1 Malware Detection and Defense . . . . . . . . . . . . . . . . . . 33 5.1.2 Smartphone (Apps) Security. . . . . . . . . . . . . . . . . . . . . 34 5.2 Conference and Workshop Proceedings . . . . . . . . . . . . . . . . . . 34 ix 6 Summary........................................... 37 References............................................ 39 Index ................................................ 43