Android malware forensics
summary
Builds a string-based author attribution pipeline that extracts URLs, class/method names and XML text from APKs (APKTool, dex2jar, JADX), converts tokens to n-grams and trains an SVM; uses certificate grouping and APK-similarity filtering. Evaluated on 1,559 benign apps (40 authors), 262 malicious apps (10 authors) and obfuscated forks; reports 98% accuracy on benign, 96% on malware and 71% on obfuscated samples, with training times of ~66s (all strings) vs ~5s (XML strings).
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:09Cybercrime and Android malware
- 7:15Static vs dynamic analysis limits
- 15:17Why focus on malware authors
- 16:21Authorship attribution basics
- 19:11String analysis approach
- 26:58Building the dataset
- 33:00Obfuscated app evaluation
- 38:28Results and contributions
- 39:51Q&A
related talks
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
29mA Day in the Life of a Mobile Malware Reverse Engineer
29mA day in the life of a mobile reverse engineer
49mAll Your Code Belongs To Us (Dismantling Android Secrets With CodeInspect)
47mAttacking Android Applications
44mAuditing Your APKs Like a Black Hat Hacker
48mA Novel Runtime Technique For Identifying Malicious Applications
29mBytecode analysis for everyone!