PuppetDroid: A User-Centric UI Exerciser for Automatic Dynamic Analysis of Similar Android Applications
Andrea Gianazza, Federico Maggi, Aristide Fattori, Lorenzo, Cavallaro, Stefano Zanero

TL;DR
PuppetDroid is a user-centric UI exerciser for Android apps that records and replays user interactions to improve dynamic analysis of malicious behaviors, outperforming existing automated methods.
Contribution
It introduces a novel approach that records and re-executes UI interactions on similar apps to enhance malware detection during dynamic analysis.
Findings
Achieves higher code coverage than automatic UI exercisers.
Effectively uncovers malicious behaviors not exposed by other methods.
Suitable for crowdsourcing to gather diverse UI interaction traces.
Abstract
Popularity and complexity of malicious mobile applications are rising, making their analysis difficult and labor intensive. Mobile application analysis is indeed inherently different from desktop application analysis: In the latter, the interaction of the user (i.e., victim) is crucial for the malware to correctly expose all its malicious behaviors. We propose a novel approach to analyze (malicious) mobile applications. The goal is to exercise the user interface (UI) of an Android application to effectively trigger malicious behaviors, automatically. Our key intuition is to record and reproduce the UI interactions of a potential victim of the malware, so as to stimulate the relevant behaviors during dynamic analysis. To make our approach scale, we automatically re-execute the recorded UI interactions on apps that are similar to the original ones. These characteristics make our system…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Software Testing and Debugging Techniques · Network Security and Intrusion Detection
