Runtime Code Slice Evaluation for Obfuscated Android Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for analyzing Android applications are hindered by obfuscation techniques such as reflection and string encryption, which make it difficult to identify malware, as they render static analyses ineffective and require user inputs for dynamic analyses, and may be tricked by malware detecting the execution environment.
Innovation Solution
A hybrid approach that extracts and evaluates runtime information by isolating program code that computes values of interest, eliminating unnecessary instructions and control-flow checks, allowing dynamic execution without user interaction and enabling further analysis with existing tools.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static analysis is used to analyze obfuscated code, then analysis can be performed without execution, but obfuscation techniques such as reflection and string encryption render the analysis ineffective
Solution Approach 1:
The patent introduces logging points as intermediary markers inserted into the code at specific locations. These logging points act as mediators between the static analysis tool and the obfuscated code, allowing the tool to track runtime values and control flow without needing to fully understand or deobfuscate the entire code. The logging points capture relevant information (such as method calls, variable values, and control flow decisions) that would otherwise be hidden by obfuscation techniques like reflection and string encryption.
2Measurement precision
If dynamic analysis is used to execute code and retrieve runtime values, then accurate runtime information can be obtained, but user inputs are required and malware may detect the execution environment
Solution Approach 1:
The patent extracts and isolates specific code slices that are relevant to computing the values of interest, separating them from the rest of the obfuscated code. By extracting only the necessary code portions that lead to logging points, the system avoids executing unnecessary code that might contain malware detection logic or require complex user interactions. This extraction process simplifies the execution environment while preserving the accuracy of runtime information retrieval.
Solution Approach 2:
The patent segments the code into distinct slices based on logging points and control flow analysis. Each slice represents a specific computational path that leads to a logging point, allowing the system to analyze and execute code in manageable segments rather than as a monolithic whole. This segmentation enables precise control over which code paths are executed and facilitates easier handling of runtime values without requiring full code execution.
3Measurement precision
If full code execution is performed to achieve complete code coverage, then all code paths are analyzed, but time-consuming operations and malicious triggers such as time bombs and logic bombs are activated
Solution Approach 1:
The patent extracts only the necessary code slices that lead to logging points, removing unnecessary instructions, control-flow checks, and potentially malicious code segments. This extraction process achieves sufficient code coverage for analyzing runtime values of interest without executing the entire codebase, thereby avoiding activation of time bombs, logic bombs, or other malicious triggers while reducing analysis time.
Solution Approach 2:
The patent applies partial action by executing only the specific code slices necessary to reach logging points and retrieve relevant runtime values, rather than performing complete code execution. This partial execution approach provides sufficient information for analysis without the time cost and security risks associated with running the entire program, including potentially malicious code paths.
4Reliability
If obfuscation techniques are applied to protect applications, then intellectual property is secured, but malware detection becomes difficult
Solution Approach 1:
The patent introduces logging points as intermediary markers that are inserted into the code at specific locations. These logging points serve as mediators that capture runtime information (such as method calls, variable values, and control flow decisions) without being affected by obfuscation techniques like reflection and string encryption. By placing logging points at strategic locations, the system can trace the execution flow and retrieve relevant values even when the code is heavily obfuscated, thereby enabling malware detection while preserving application security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments provide apparatuses, mobile devices, methods and computer programs for evaluating runtime information of an extracted set of instructions based on at least a part of a computer program. An apparatus (10) comprises an interface (12) to obtain the information related to the extracted set of instructions and information related to one or more logging points and an evaluation module (14) to provide the runtime information, based on the information related to the extracted set of instructions and the information related to the logging points. The evaluation module (14) is configured to provide the runtime information by at least partly executing one or more subsets of program instructions comprised in the extracted set of instructions.