NDLI: GroddDroid: a gorilla for triggering malicious behaviors

Content Provider	IEEE Xplore Digital Library
Author	Abraham, A. Andriatsimandefitra, R. Brunelat, A. Lalande, J.-F. Viet Triem Tong, V.
Copyright Year	2015
Description	Author affiliation: INSA Centre Val de Loire, Univ. Orleans LIFO EA 4022, F-18020 Bourges, France (Lalande, J.-F.) \|\| y ENS Cachan F-94230 Cachan, France (Abraham, A.) \|\| EPI CIDRE, CentraleSupelec, Inria, Universite de Rennes 1, CNRS IRISA UMR 6074, F-35065 Rennes, France (Andriatsimandefitra, R.; Brunelat, A.; Viet Triem Tong, V.)
Abstract	Android malware authors use sophisticated techniques to hide the malicious intent of their applications. They use cryptography or obfuscation techniques to avoid detection during static analysis. They can also avoid detection during a dynamic analysis. Frequently, the malicious execution is postponed as long as the malware is not convinced that it is running in a real smartphone of a real user. However, we believe that dynamic analysis methods give good results when they really monitor the malware execution. In this article1, we propose a method to enhance the execution of the malicious code of unknown malware. We especially target malware that have triggering protections, for example branching conditions that wait for an event or expect a specific value for a variable before triggering malicious execution. In these cases, solely executing the malware is far from being sufficient. We propose to force the triggering of the malicious code by combining two contributions. First, we define an algorithm that automatically identifies potentially malicious code. Second, we propose an enhanced monkey called GroddDroid, that stimulates the GUI of an application and forces the execution of some branching conditions if needed. The forcing is used by GroddDroid to push the execution flow towards the previously identified malicious parts of the malware and execute it. The source code for our experiments with GroddDroid is released as free software2. We have verified on a malware dataset that we investigated manually that the malicious code is accurately executed by GroddDroid. Additionally, on a large dataset of 100 malware we precisely identify the nature of the suspicious code and we succeed to execute it at 28%.
Starting Page	119
Ending Page	127
File Size	775283
Page Count	9
File Format	PDF
ISBN	9781509003174
e-ISBN	9781509003198
DOI	10.1109/MALWARE.2015.7413692
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-10-20
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Java Force Humanoid robots Malware Androids Monitoring Graphical user interfaces
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Behavioral Analysis of Android Applications Using Automated Instrumentation

Systematic testing for resource leaks in Android applications

GUIdiff -- A Regression Testing Tool for Graphical User Interfaces

Detection of Android Malicious Apps Based on the Sensitive Behaviors

One implementation of UI TV application on adnroid STB

A toolset for GUI testing of Android applications

A Software Environment for Confining Malicious Android Applications via Resource Virtualization

A graphical language for LTL motion and mission planning

Detection and Identification of Android Malware Based on Information Flow Monitoring

GroddDroid: a gorilla for triggering malicious behaviors

Similar Documents

Behavioral Analysis of Android Applications Using Automated Instrumentation

Systematic testing for resource leaks in Android applications

GUIdiff -- A Regression Testing Tool for Graphical User Interfaces

Detection of Android Malicious Apps Based on the Sensitive Behaviors

One implementation of UI TV application on adnroid STB

A toolset for GUI testing of Android applications

A Software Environment for Confining Malicious Android Applications via Resource Virtualization

A graphical language for LTL motion and mission planning

Detection and Identification of Android Malware Based on Information Flow Monitoring

GroddDroid: a gorilla for triggering malicious behaviors