CopperDroid: Automatic Reconstruction of Android Malware Behaviors

By Kimberly Tam, Salahuddin J. Khan, Aristide Fattori, Lorenzo Cavallaro. Network and Distributed System Security Symposium, 2015

443 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/b38fd5f9ec3ce75455946de5913549b5f660b22e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Evaluating Analysis Tools for Android Apps: Status Quo and Robustness Against Obfuscation (2016, background): “For example, the currently available version of CopperDroid [40,48] was not able to analyze our applications as it required apps compiled against a rather old Android version 2.”
*droid (2016, background): “CopperDroid [Tam et al. 2015], on the other hand, takes a different approach for portability reasons, demonstrating that it is possible to reconstruct events such as Binder IPC through behavioral analysis of the captured system calls.”
Exploring Backdoor Poisoning Attacks Against Malware Classifiers (2020, background): “Dynamic analysis systems execute binary files in a virtualized environment, and record the behavior of the sample looking for indicators of malicious activities [8, 29, 36, 43, 49].”
MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (2016, background): “However, as it is unrealistic to deploy dynamic analysis techniques directly on users’ devices, due to the overhead they introduce, these are typically used ofﬂine [45], [50], [67].”
Following Devil's Footprints: Cross-Platform Analysis of Potentially Harmful Libraries on Android and iOS (2016, background): “A lot of effort has been made to analyze and detect Android PHAs, most of which aims at detecting the code [37], [38], [39], [40], [41], [42], [43], [44], [45] for performing potentially harmful behaviors (e.g., stealing the user’s sensitive information), and protecting the Android system from…”
On the effectiveness of system API-related information for Android ransomware detection (2018, methodology): “Tam et al. introduced a system to perform dynamic analysis and detection of Android malware by analyzing the system calls performed by the application [26].”
Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential Analysis (2017, methodology): “While aforementioned approaches only track data flow in the Dalvik VM, there also exist approaches that also can track data flow in native code: DroidScope [47] and CopperDroid [41] perform full system emulation and inspect both an app’s Dalvik and native code for the purpose of malware analysis, wh”