An API calls monitoring-based method for effectively detecting malicious repackaged applications

Abstract

The number of mobile applications on android platform has largely increased in recent years. The security problems, as one of the outcomes induced by the popularity of android, become more and more critical. Malicious repackaged applications (MRAs) perform malicious behaviors through malware developers embedding malicious codes into the benign origin applications (BOAs), which threat the security of users' finance and privacy. In this paper, a method based on API calls monitoring is proposed to effectively detect MRAs. We discuss the characteristics of behaviors and analyze the differences in API calls between MRAs and their BOAs. A MRA detection model is established, which builds up the super-sphere for each BOA via a SVDD algorithm. The model can detect the abnormal behaviors of MRAs which deviate the normal behaviors of corresponding BOAs. Experiments are carried out on imitated and real MRAs, where the results demonstrate the effectiveness of our method for detecting the singly and multiply contaminated BOAs.