A collaborative framework for android malware detection using DNS & dynamic analysis

Abstract

Nowadays, with the predominance of smart devices such as smartphones, mobile malware attacks have increasingly proliferated. There is an urgent need of detecting potential malicious behaviors so as to hinder them. Furthermore, Android malware is one of the major security issues and fast growing threats facing the Internet in the mobile arena. At the same time, DNS (Domain Name System) is widely misused by miscreants in order to provide Internet connection within malicious networks. Here, we propose an infrastructure for monitoring the Android applications in a platform-independent manner, introducing hooks in order to trace restricted API calls used at runtime of the application. These traces are collected at a central server were the application behavior filtering, string matching, and visualization takes place. From these traces we can extract malicious URLs and correlate them with DNS service network traffic, enabling us to find presence of malware running at the network level.