On The (In)Effectiveness of Static Logic Bomb Detection for Android Apps

Research output: Contribution to journalJournal articleResearchpeer-review

Documents

  • Fulltext

    Final published version, 946 KB, PDF document

  • Jordan Samhi
  • Alexandre Bartel

Android is present in more than 85% of mobile devices, making it a prime target for malware. Malicious code is becoming increasingly sophisticated and relies on logic bombs to hide itself from dynamic analysis. In this article, we perform a large scale study of TSOpen, our open-source implementation of the state-of-the-art static logic bomb scanner TriggerScope, on more than 500k Android applications. Results indicate that the approach scales. Moreover, we investigate the discrepancies and show that the approach can reach a very low false-positive rate, 0.3%, but at a particular cost, e.g., removing 90% of sensitive methods. Therefore, it might not be realistic to rely on such an approach to automatically detect all logic bombs in large datasets. However, it could be used to speed up the location of malicious code, for instance, while reverse engineering applications. We also present TrigDB a database of 68 Android applications containing trigger-based behavior as a ground-truth to the research community.

Original languageEnglish
JournalIEEE Transactions on Dependable and Secure Computing
Volume19
Issue number6
Pages (from-to)3822-3836
ISSN1545-5971
DOIs
Publication statusPublished - 2022

Bibliographical note

Publisher Copyright:
© 2004-2012 IEEE.

    Research areas

  • android applications security, Logic bombs, static analysis, trigger analysis

ID: 344441318