DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis

By Lok K. Yan, Heng Yin. USENIX Security Symposium, 2012

770 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/519b17ea300eda0e30ac00f532db48215b56b354

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Following Devil's Footprints: Cross-Platform Analysis of Potentially Harmful Libraries on Android and iOS (2016, background): “A lot of effort has been made to analyze and detect Android PHAs, most of which aims at detecting the code [37], [38], [39], [40], [41], [42], [43], [44], [45] for performing potentially harmful behaviors (e.g., stealing the user’s sensitive information), and protecting the Android system from…”
WHYPER: Towards Automating Risk Assessment of Mobile Applications (2013, background): “Previous work has looked at permissions [2–5], code [6–10], and run-time behavior [11–13].”
Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential Analysis (2017, methodology): “While aforementioned approaches only track data flow in the Dalvik VM, there also exist approaches that also can track data flow in native code: DroidScope [47] and CopperDroid [41] perform full system emulation and inspect both an app’s Dalvik and native code for the purpose of malware analysis, wh”
Evaluating Analysis Tools for Android Apps: Status Quo and Robustness Against Obfuscation (2016, methodology): “DroidScope [58] is a dynamic binary instrumentation tool that uses a virtualization-based analysis.”
DroidDetector: Android Malware Characterization and Detection Using Deep Learning (2016, methodology): “…presented in Section 2, many other characteristics can also be used as features, such as the four-layer proﬁles generated by ProﬁleDroid [32] , the three tiered APIs exported by DroidScope [33] , the program semantics generated by DroidSIFT [20] , and the data-ﬂow semantics extracted in Ref.”
DroidAPIMiner: Mining API-Level Features for Robust Malware Detection in Android (2013, background): “Yan, L.K., Yin, H.: DroidScope: Seamlessly Reconstructing the OS and Dalvik Se- mantic Views for Dynamic Android Malware Analysis.”
ANDRUBIS -- 1,000,000 Apps Later: A View on Current Android Malware Behaviors (2014, methodology): “DroidScope [9] is a dynamic analysis system solely based on VMI.”
Android Security: A Survey of Issues, Malware Penetration, and Defenses (2015, methodology): “Due to this, they are usually deployed off-device [30], [80], [90], [113].”
The Evolution of Android Malware and Android Analysis Techniques (2017, methodology): “…of Android analysis approaches to obtain detailed behavioral proﬁles [Enck et al. 2010; Zheng et al. 2012; Wei et al. 2012a; Au et al. 2012; Yan and Yin 2012; Tam et al. 2015b; Anand et al. 2012; Wei et al. 2012b] and assess the malware threat [Felt et al. 2011; Enck et al. 2011; Felt et al.…”
Vetting undesirable behaviors in android apps with permission use analysis (2013, methodology): “DroidScope [56] seems to notice these problems by seamlessly reconstructing the semantics from system calls and Java.”
AppsPlayground: automatic security analysis of smartphone applications (2013, methodology): “More recently, DroidScope [30] used dynamic analysis for malware forensics.”
MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (2016, unknown): “DroidScope [59] and TaintDroid [19] monitor run-time app behavior in a protected environment to perform dynamic taint analysis.”
FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps (2014, background): “Aurasium [38] and DroidScope [39] largely suffer from the same shortcomings with respect to static leak detection.”
A Multimodal Deep Learning Method for Android Malware Detection Using Various Features (2019, methodology): “The malware detection approaches can be classified into two categories; static analysis based detection [2]–[19] and dynamic analysis based detection [20]–[24].”
Dynodroid: an input generation system for Android apps (2013, background): “Categories and Subject Descriptors D.2.5 [Software Engineering]: Testing and Debugging General Terms Reliability, Experimentation Keywords GUI testing, testing event-driven programs, Android”