Dynamic Security Analysis on Android: A Systematic Literature Review

Fast contingency screening and efficient preventive control are two of the necessary integral functions of dynamic security analysis (DSA). Contingency screening requires the use of severity indices, and for DSA such an index should be a measure of system stability. In this paper, three time-domain simulation based indices are proposed for ranking of contingencies and generation rescheduling in DSA. These indices are energy margin index (EMI) based on hybrid extended equal area criteria (EEAC), transient energy index (TEI) based on hybrid transient energy function (TEF), and critical clearing time (CCT). Results on realistic power systems are presented to show their relative merit for use in contingency screening and generation rescheduling.

Objectives: 1. To propose a framework for Malware Classification System (MCS) to analyze malware behavior dynamically using a concept of information theory and a machine learning technique. 2. To extract behavioral patterns from execution reports of malware in terms of its features and generates a data repository. 3. To select the most promising features using information theory based concepts. Methods/Statistical Analysis: Today, malware is a major concern of computer security experts. Variety and in- creasing number of malware affects millions of systems in the form of viruses, worms, Trojans etc. Many techniques have been proposed to analyze the malware to its class accurately. Some of analysis techniques analyzed malware based upon its structure, code flow, etc. without executing it (called static analysis), whereas other techniques (termed as dynamic analysis) focused to monitor the behavior of malware by executing it and comparing it with known malware behavior. Dynamic analysis has proved to be effective in malware detection as behavior is more difficult to mask while executing than its underlying code (static analysis). In this study, we propose a framework for Malware Classification System (MCS) to analyze malware behavior dynamically using a concept of information theory and a machine learning technique. The proposed framework extracts behavioral patterns from execution reports of malware in terms of its features and generates a data repository. Further, it selects the most promising features using information theory based concepts. Findings: The proposed framework detects the family of unknown malware samples after training of a classifier from malware data repository. We validated the applicability of the proposed framework by comparing with the other dynamic malware analysis technique on a real malware dataset from Virus Total. Application: The proposed framework is a Malware Classification System (MCS) to analyze malware behavior dynamically using a concept of information theory and a machine learning technique.

As an important program analysis method, taint analysis technology has been widely used in the field of vulnerability detection. However, the existing dynamic taint analysis needs to design instruction-by-instruction taint propagation rules, which is expensive and has a high false positive rate for identifying the implicit control flow of the target program. In view of the above problems, this paper proposes a dynamic taint analysis method nnTaint based on neural network for the existing taint-guided fuzzing technology, which has the characteristics of low cost and low false positives. Comparing nnTaint with the existing taint analysis tools, the operation efficiency is improved by 10.9%-18.8% compared with the traditional taint analysis, which reduces the cost of the existing dynamic taint analysis technology to a certain extent. On the LAVA-M testing datasets and GNU binutils program, nnTaint improves the edge coverage by 4.7%-16% compared with the existing taint-guided fuzzing tools, effectively improving the implicit control flow recognition accuracy of the existing dynamic taint analysis. The results show that nnTaint can improve the efficiency and accuracy of existing dynamic taint analysis tools.

Antivirus companies, mobile application marketplaces, and the security research community, employ techniques based on dynamic code analysis to detect and analyze mobile malware. In this paper, we present a broad range of anti-analysis techniques that malware can employ to evade dynamic analysis in emulated Android environments. Our detection heuristics span three different categories based on (i) static properties, (ii) dynamic sensor information, and (iii) VM-related intricacies of the Android Emulator. To assess the effectiveness of our techniques, we incorporated them in real malware samples and submitted them to publicly available Android dynamic analysis systems, with alarming results. We found all tools and services to be vulnerable to most of our evasion techniques. Even trivial techniques, such as checking the value of the IMEI, are enough to evade some of the existing dynamic analysis frameworks. We propose possible countermeasures to improve the resistance of current dynamic analysis tools against evasion attempts.

Dynamic taint analysis (DTA) is to analyze execution paths that an attacker may use to exploit a system. Dynamic taint analysis is a method to analyze executable files by tracing information flow without source code. DTA marks certain inputs to program as tainted, and then propagates values operated with tainted inputs. Due to the increased popularity of dynamic taint analysis, there have been a few recent research approaches to provide a generalized tainting infrastructure. In this paper, we introduce some approaches of dynamic taint analysis, and analyze their approaches. Lam and Chiueh's approach proposed a method that instruments code to perform taint marking and propagation. DYTAN considers three dimensions: taint source, propagation policies, taint sink. These dimensions make DYTAN to be more general framework for dynamic taint analysis. DTA++ proposes an idea to vanilla dynamic taint analysis that propagates additional taints along with targeted control dependencies. Control dependency causes results of taint analysis to have decreased accuracies. To improve accuracies, DTA++ showed that data transformation containing implicit flows should propagate properly to avoid under-tainting.

Malware detection is crucial for protecting digital environments. Traditional methods involve static and dynamic analysis, but recent advancements leverage artificial intelligence (AI) to enhance detection accuracy. This study aims to improve malware detection by integrating dynamic malware analysis with AI-driven techniques. The primary challenge addressed is accurately classifying and detecting malware based on behavior extracted from isolated virtual machines. By analyzing 50 malware samples and 11 benign programs, we extract ten behavioral features such as process ID, CPU usage, and network connections. We employ text-based classification using feedforward neural networks (FNN) and recurrent neural networks (RNN), achieving accuracy rates of 56% and 68%, respectively. Additionally, we convert the extracted features into grayscale images for image-based classification with a convolutional neural network (CNN), resulting in a higher accuracy of 70.1%. This multi-modal approach, combining behavioral analysis with AI, not only enhances detection accuracy but also provides a comprehensive understanding of malware behavior compared to competing methods.

In this paper, we proposed a tool framework of static analyzer for taint analysis of binary executable file. Dynamic taint analysis is becoming principal technique in security analysis. In particular, proposed system focuses on tracing a dynamic taint analysis. Moreover, most existing approaches are focused on data-flow based tainting. The modules of this paper use two kinds of input file type which are taint_trace file and binary executable file. Proposed system analyzes the result of dynamic taint analysis and makes control flow graph. Our proposed system is divided by three modules; taint reader, crash analyzer and code tracker. Trace reader converts trace file into readable/traceable information for a manual analyzer. Crash analyzer find out a vulnerability that is a causative factor in accrued crash. Code tracker supports a variety of binary executable file analysis. In this paper, we suggest a tool framework for dynamic taint analysis.

In this survey, we review the key developments in the field of malware detection using AI and analyze core challenges. We systematically survey state-of-the-art methods across five critical aspects of building an accurate and robust AI-powered malware-detection model: malware sophistication, analysis techniques, malware repositories, feature selection, and machine learning vs. deep learning. The effectiveness of an AI model is dependent on the quality of the features it is trained with. In turn, the quality and authenticity of these features is dependent on the quality of the dataset and the suitability of the analysis tool. Static analysis is fast but is limited by the widespread use of obfuscation. Dynamic analysis is not impacted by obfuscation but is defeated by ubiquitous anti-analysis techniques and requires more computational power. Sophisticated and evasive malware is challenging to extract authentic discriminatory features from and, combined with poor quality datasets, this can lead to a situation where a model achieves high accuracy with only one specific dataset.

Breaking into BIM: Performing static and dynamic security analysis with the aid of BIM

Owing to its advantages such as high reliability for power supply, flexible operating and dispatching mechanism and convenient transfer breaker, the 3/2 mode of connection has been greatly put into use in 500kv power stations and some 200kv load-center substations. However, more equipment may be subjected to power cut caused by some fault modes as long as the mode of connection is linked with primary equipment or the breaker is under the prophylactic repair mode. Based on the analysis of network topology and on-line identification technology to deal with equipment risk for protection and operation logic, it enables itself to automatically identify the latent fault mode which is contained within power-failure equipment with N-2 qualification or more and remind relevant dispatching working staff in accordance of the prophylactic repair of primary equipment or breaker under the mode of connection, meanwhile, through the combination of static and dynamic security analysis and maintenance scheduling, it will achieve the on-line prevention and control mechanism for equipment risk in large power grid.

This article addresses the use of software tools by engineers, operators, and planners to handle complex issues in less amounts of time. The topics of the article include applications of artificial intelligence (AI) in power system operations applications such as customer restoration and fault testing, voltage and VAR dispatch, dynamic security analysis, voltage collapse, control center load management assistance, optimal power flow, and power system restoration; and applications in power system planning such as training, data verification, stability studies, load forecasting, outage scheduling, ranking of alternatives, power transaction evaluation, and evaluation of third-party generation alternatives.

For the last few years, Android is known to be the most widely used operating system and this rapidly increasing popularity has attracted the malware developer’s attention. Android allows downloading and installation of apps from other unofficial market places. This gives malware developers an opportunity to put repackaged malicious applications in third-party app-stores and attack the Android devices. A large number of malware analysis and detection systems have been developed which uses static analysis, dynamic analysis, or hybrid analysis to keep Android devices secure from malware. However, the existing research clearly lags in detecting malware efficiently and accurately. For accurate malware detection, multilayer analysis is required which consumes large amount of hardware resources of resource constrained mobile devices. This research proposes an efficient and accurate solution to this problem, named SAMADroid, which is a novel 3-level hybrid malware detection model for Android operating systems. The research contribution includes multiple folds. First, many of the existing Android malware detection techniques are thoroughly investigated and categorized on the basis of their detection methods. Also, their benefits along with limitations are deduced. A novel 3-level hybrid malware detection model for Android operating systems is developed, that can provide high detection accuracy by combining the benefits of the three different levels: 1) Static and Dynamic Analysis; 2) Local and Remote Host; and 3) Machine Learning Intelligence. Experimental results show that SAMADroid achieves high malware detection accuracy by ensuring the efficiency in terms of power and storage consumption.

Malware detection has played a crucial role in many cyberattacks in recent years. Due to the obfuscated nature of malware, the traditional static analysis technique tends to be ineffective. Additionally, modern malware often can identify dynamic analysis environments, posing challenges to dynamic analysis methods. Thus, feature extraction relies on analysis techniques that tend to be less effective in obfuscated malware, resulting in poor performance of subsequent machine learning-based detectors. This study introduces a Bypass Anti-emulation-based Malware Detection framework (BAE-MD) for enhancing the efficiency of obfuscated malware detection. In other words, BAE-MD includes a method that can bypass the anti-emulation mechanism of malware in a controlled dynamic environment. This forces the malware to decrypt and decompress its actual malicious code to memory. By doing so, Yara rules can be applied to memory dump to extract more than $60$ features to feed into detectors. BAE-MD is evaluated on a malware dataset in comparison with others using static and dynamic analysis technique-based feature extraction. The experimental results can confirm that our method outperforms the others. More investigations are also carried out to illustrate the efficiency of BAE-MD. These results suggest that BAE-MD is a promising approach for dealing with the continuous evolution of malware.

A novel deep learning-based approach for malware detection

Malware is a broad term for harmful software that poses significant threats by damaging computer systems and spreading across networks. Traditional detection methods include signature-based and heuristic-based techniques, which are effective against known malware but struggle with new, unknown variants, particularly sophisticated ones like metamorphic, encrypted, and polymorphic viruses. Hence, this research aims at improving malware detection, specifically targeting metamorphic malware that can evade traditional detection methods. The study shows the effectiveness of dynamic analysis over static analysis for detecting metamorphic malware due to its ability to adapt to the malware's constant changes. The dynamic analysis involves examining malware behavior during execution, using dynamic software birthmarks and the Hidden Markov Model to identify malicious activities. It therefore recommends the use of dynamic analysis in the detection of patterns of metamorphic malware. Keywords: Hidden markov models, Malware detection, Dynamic analysis and Static analysis