.png){kind=icon}
返回
Secure Repackage-Proofing Framework for Android Apps Using Collatz Conjecture
.png){kind=icon}
OA
AI
DOI：10.1109/TDSC.2021.3091654.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
App repackaging has been raising serious concerns about the health of the Android ecosystem, and repackage-proofing is an important mitigation against threat of such attacks. However, existing app repackage-proofing schemes were only evaluated against trivial adversaries simulated using analyzers for other purposes (e.g., disclosing privacy leakage vulnerabilities), hence were shown effective mainly because their key programming features were not even supported by those toolkits. Furthermore, existing works have also neglected dynamic adversaries capable of manipulating victim apps at runtime, making them vulnerable against such stronger opponents. In this article, we propose a novel repackage-proofing framework, which deploys distributed detection and response sites into the subject app's native partition to cross-verify all its code files. The detection sites transmit obtained integrity metrics to response sites via secure communication channels built on the subject app's own control flows using a specialized obfuscation technique based on Collatz conjecture, turning the repackage-proofing process into complicated implicit flows that are intrinsically difficult to be resolved due to the conjecture's nonlinear dynamical behaviors. We evaluated our framework using sophisticated Android data-flow analyzers. Results showed that our prototype effectively impeded analyses aiming to trace the information flows of its cross-verification.
Keyword:
Payloads
Smart phones
Measurement
Runtime
Communication channels
Weapons
Manipulator dynamics
App repackaging
repackage-proofing
code obfuscation
collatz conjecture
期刊
IF:
7.5
论文数:
2.4K
被引数:
9.6K
机构
引用论文
.png){kind=icon}
分享收藏Understanding Android App Piggybacking: A Systematic Study of Malicious Code Grafting理解Android应用捎带: 恶意代码嫁接的系统研究
OAAI
OAAI分享收藏Amandroid: A Precise and General Inter-component Data Flow Analysis Framework for Security Vetting of Android AppsAmandroid: 一种用于Android应用安全审查的精确通用组件间数据流分析框架
PREAI
分享收藏分享收藏
查看更多内容