Towards Discovering and Understanding Unexpected Hazards in Tailoring Antivirus Software for Android

In its latest comparison of Android Virus Detectors (AVDs), the independent lab AV-TEST reports that they have around 95% malware detection rate. This only indicates that current AVDs on Android have good malware signature databases. When the AVDs are deployed on the fast-evolving mobile system, their effectiveness should also be measured on their runtime behavior. Therefore, we perform a comprehensive analysis on the design of top 30 AVDs tailored for Android. Our new understanding of the AVDs’ design leads us to discover the hazards in adopting AVD solutions for Android, including hazards in malware scan (malScan) mechanisms and the engine update (engineUpdate). First, the malScan mechanisms of all the analyzed AVDs lack comprehensive and continuous scan coverage. To measure the seriousness of the identified hazards, we implement targeted evasions at certain time (e.g., end of the scan) and locations (certain folders) and find that the evasions can work even under the assumption...

• Type: Journal
• Year: 2015
• Where: CCS
• Authors: Heqing Huang, Kai Chen 0012, Chuangang Ren, Peng Liu 0005, Sencun Zhu, Dinghao Wu
• Keywords: CCS 2015, Security Privacy