DynaFrame: A Framework for Detection and Analysis of Dynamic Code in Android Apps
The number of smartphone users is increasing exponentially due to the Android phone's economic availability and popularity. The malware authors started developing new techniques whenever Google introduced new security and privacy parameters in some recent versions of Android. Nowadays, detecting and analysing malicious activity in modern smartphone malware that employs dynamic code is very difficult. Such malware uses advanced techniques of dynamic code, such as implementing Java Reflection API to expand its malicious functionality during the execution of apps. Unfortunately, malicious app developers often exploit Dynamic code techniques to transform seemingly benign apps into malware once installed on real devices. Even the most sophisticated static analysis tools struggle to detect data breaches caused by Dynamic code. Our analysis demonstrates that conventional tools are ill-equipped to handle such dynamic code. Our proposed framework, DynaFrame, incorporates static and dynamic analysis techniques to detect information leaks due to the presence of dynamic code. DynaFrame leverages dynamic code interposition techniques for API hooking to expose concealed malicious behaviour without requiring modifications to the Android framework. We evaluate the performance of the proposed framework using a dataset comprising real-world benign and malware apps collected from various reputed repositories.
Please access our dataset using the Google Drive URL with prior permission. https://drive.google.com/drive/folders/1t0wd46S5sxb1JzvuMgdRLIEqH8Tph4_6?usp=share_link