2013/11/17 by Shuying Liang, Matthew Might, Liang, Shuying +3
Computer Science · #Advanced Malware Detection Techniques #FOS: Computer and information sciences #Network Security and Intrusion Detection #Programming Languages (cs.PL) #Software Testing and Debugging Techniques #cs.PL
paper · pdf · doi:10.48550/arxiv.1311.4198
Appears in the Workshop on Tools for Automatic Program Analysis, Seattle, Washington, June 2013
arxiv created 2013/11/17 · openalex publication_date 2013/11/17 · arxiv updated 2013/11/19 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Today's mobile platforms provide only coarse-grained permissions to users with regard to how third- party applications use sensitive private data. Unfortunately, it is easy to disguise malware within the boundaries of legitimately-granted permissions. For instance, granting access to "contacts" and "internet" may be necessary for a text-messaging application to function, even though the user does not want contacts transmitted over the internet. To understand fine-grained application use of permissions, we need to statically analyze their behavior. Even then, malware detection faces three hurdles: (1) analyses may be prohibitively expensive, (2) automated analyses can only find behaviors that they are designed to find, and (3) the maliciousness of any given behavior is application-dependent and subject to human judgment. To remedy these issues, we propose semantic-based program analysis, with a human in the loop as an alternative approach to malware detection. In particular, our analysis allows analyst-crafted semantic predicates to search and filter analysis results. Human-oriented semantic-based program analysis can systematically, quickly and concisely characterize the behaviors of mobile applications. We describe a tool that provides analysts with a library of the semantic predicates and the ability to dynamically trade speed and precision. It also provides analysts the ability to statically inspect details of every suspicious state of (abstract) execution in order to make a ruling as to whether or not the behavior is truly malicious with respect to the intent of the application. In addition, permission and profiling reports are generated to aid analysts in identifying common malicious behaviors.