AppAngio: Revealing Contextual Information of Android App Behaviors by API-Level Audit Logs
Zhaoyi Meng, Yan Xiong, Wenchao Huang, Fuyou Miao, Jianmeng Huang

TL;DR
AppAngio is a system that analyzes Android app audit logs to reveal contextual behavior information, aiding malicious behavior detection with minimal performance impact.
Contribution
It introduces a divide and conquer log matching strategy on control-flow graphs to improve analysis accuracy and efficiency.
Findings
Effective in revealing app behavior context in real-world apps.
Assists analysts in identifying malicious app behaviors.
Imposes negligible performance overhead on Android devices.
Abstract
Android users are now suffering severe threats from unwanted behaviors of various apps. The analysis of apps' audit logs is one of the essential methods for some device manufacturers to unveil the underlying malice within apps. We propose and implement AppAngio, a novel system that reveals contextual information in Android app behaviors by API-level audit logs. Our goal is to help analysts of device manufactures understand what has happened on users' devices and facilitate the identification of the malice within apps. The key module of AppAngio is identifying the path matched with the logs on the app's control-flow graph (CFG). The challenge, however, is that the limited-quantity logs may incur high computational complexity in the log matching, where there are a large number of candidates caused by the coupling relation of successive logs. To address the challenge, we propose a divide…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Network Security and Intrusion Detection · Software Testing and Debugging Techniques
