Eight Years of Rider Measurement in the Android Malware Ecosystem: Evolution and Lessons Learned
Guillermo Suarez-Tangil, Gianluca Stringhini

TL;DR
This study provides the largest analysis to date of Android malware evolution over eight years, revealing changes in malicious behaviors and obfuscation techniques, and offering insights for improving detection methods.
Contribution
It introduces a comprehensive analysis framework for studying repackaged Android malware, utilizing differential analysis and multi-AV data to understand malware evolution over time.
Findings
Malware behaviors have significantly evolved since 2010.
Obfuscation techniques have increased to evade detection.
The framework aids analysts in studying unknown malware families.
Abstract
Despite the growing threat posed by Android malware, the research community is still lacking a comprehensive view of common behaviors and trends exposed by malware families active on the platform. Without such view, the researchers incur the risk of developing systems that only detect outdated threats, missing the most recent ones. In this paper, we conduct the largest measurement of Android malware behavior to date, analyzing over 1.2 million malware samples that belong to 1.2K families over a period of eight years (from 2010 to 2017). We aim at understanding how the behavior of Android malware has evolved over time, focusing on repackaging malware. In this type of threats different innocuous apps are piggybacked with a malicious payload (rider), allowing inexpensive malware manufacturing. One of the main challenges posed when studying repackaged malware is slicing the app to split…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Network Security and Intrusion Detection · Software Testing and Debugging Techniques
