Elsersy Wael F, Feizollah Ali, Anuar Nor Badrul
Department of Computer System and Technology/Faculty of Computer Science and Information Technology, Universiti Malaya, Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur, Malaysia.
PeerJ Comput Sci. 2022 Mar 9;8:e907. doi: 10.7717/peerj-cs.907. eCollection 2022.
The various application markets are facing an exponential growth of Android malware. Every day, thousands of new Android malware applications emerge. Android malware hackers adopt reverse engineering and repackage benign applications with their malicious code. Therefore, Android applications developers tend to use state-of-the-art obfuscation techniques to mitigate the risk of application plagiarism. The malware authors adopt the obfuscation and transformation techniques to defeat the anti-malware detections, which this paper refers to as evasions. Malware authors use obfuscation techniques to generate new malware variants from the same malicious code. The concern of encountering difficulties in malware reverse engineering motivates researchers to secure the source code of benign Android applications using evasion techniques. This study reviews the state-of-the-art evasion tools and techniques. The study criticizes the existing research gap of detection in the latest Android malware detection frameworks and challenges the classification performance against various evasion techniques. The study concludes the research gaps in evaluating the current Android malware detection framework robustness against state-of-the-art evasion techniques. The study concludes the recent Android malware detection-related issues and lessons learned which require researchers' attention in the future.
各个应用市场正面临着安卓恶意软件呈指数级增长的情况。每天都有成千上万的新安卓恶意软件应用出现。安卓恶意软件黑客采用逆向工程，并将恶意代码重新打包到良性应用中。因此，安卓应用开发者倾向于使用最先进的混淆技术来降低应用被抄袭的风险。恶意软件作者采用混淆和转换技术来逃避反恶意软件检测，本文将其称为规避。恶意软件作者使用混淆技术从相同的恶意代码生成新的恶意软件变体。在恶意软件逆向工程中遇到困难的担忧促使研究人员使用规避技术来保护良性安卓应用的源代码。本研究回顾了最先进的规避工具和技术。该研究批评了最新安卓恶意软件检测框架中现有的检测研究差距，并对针对各种规避技术的分类性能提出了挑战。该研究总结了在评估当前安卓恶意软件检测框架针对最先进规避技术的鲁棒性方面的研究差距。该研究总结了近期与安卓恶意软件检测相关的问题以及经验教训，这些在未来需要研究人员予以关注。
