Awesome

Software and Network Security - A.Y. 2014-2015 Department of Engineering, University of Sannio, Benevento, Italy

Supervisors: Prof. Corrado Aaron Visaggio, email: aaron.visaggio@gmail.com, web: http://www.aaronvisaggio.it/ Francesco Mercaldo, email: fmercaldo@gmail.com Developers: Agostino De Lucia, email: agostino.delucia@hotmail.it Raffaele Esposito, email: e_raffaele@alice.it Michele Meninno, email: michele.meninno@gmail.com Pasquale Battista, email: pas.battista@gmail.com

Android Malware Evaluating Tools

In order to accomplish a deep antimalwares' detection algorithms analysis, we developed two different tools, both coded in Java.

The first tool, named Alan, through a simple UI, provides the application of eight different smali code transformations (detailed informations about these transformations can be found into the paper attached with the project). This tool contains other two free tools (signapk, apktool) used to decompile and recompile an android application, providing almost original resources of the application. The tool works on smali code, a human readable dalvik bytecode. The aim of these transformations is hiding a malicious behaviour of an application from static malware scanning techniques. A transformed application can be submitted on the website <a href="www.virustotal.com">VirusTotal</a> where it can be analyzed by 57 well-known (free and paid) anti-malwares.

In order to work on a large malaware data-set, we developed a second tool, composed basically of code enabling an automatic upload of the android applications on virus-total, using his specific java API, storing result analysis on a relational database (we provide the schema in the project). This tool provides a simple UI to select among several queries, presenting results on html files Everything is well-documented and ready to be improved for future works.

If you are interested in the results of the study we've carried out analyzing how 57 antimalwares from <a href="www.virustotal.com">VirusTotal</a> perform against 5600 malwares, before and after the application of obfuscating transformations, you can contact us.