Static Adversarial Method

As Android systems become targets of malicious software attacks, researchers and developers are exploring methods to prevent malware infiltration into Android devices. To counter researchers’ security measures and further increase the spread and penetration of malware, malicious authors use static obfuscation techniques to evade detection. This chapter first introduces three static obfuscation techniques: code obfuscation, resource obfuscation, and manifest file obfuscation. Code obfuscation increases code complexity and ambiguity by modifying identifiers and removing unused code. Resource obfuscation increases the difficulty of decompilation by randomizing resource file names and directories. Manifest file obfuscation enhances app security by replacing component names, permission names, and metadata. Static obfuscation techniques effectively prevent attacks, such as APK decompilation, injection, and tampering, but may impact app performance and user experience and increase app complexity and maintenance costs. Then, common APK static obfuscation tools are presented, including Obfuscapk, ProGuard, DexGuard, Allatori, DashO, Bangcle, and Arxan. These tools were originally designed to protect app security by obfuscating the code to prevent reverse engineering, tampering, and piracy. However, they are also used by malicious software developers to achieve static evasion. To combat malware that uses static obfuscation techniques, researchers have begun using new detection strategies. They explore more difficult-to-obfuscate static features, such as user interface perceptual hashes and grayscale images, to identify malicious software. They also combine dynamic analysis or machine learning to counter the impact of static obfuscation on analysis. Finally, the chapter summarizes some research work related to static obfuscation.