Dynamic Adversarial Method in Android Malware

With the development and popularization of Android malware detection technology, there are sundry Android malware detection and defense methods in the industry and academia. In order to evade these detections, malware developers have also begun to adopt countermeasures to remain in user terminals to achieve malicious purposes. The previous chapter has introduced the common methods and detection methods of static confrontation technology. However, in reality, deploying such detection methods and confrontation methods requires a lot of cost. The best way to combat static confrontation is dynamic analysis. Because security personnel only need to run the sample to collect the observed behaviors during dynamic analysis and do not need to perform special treatment on the obfuscation, encryption, hardening, dynamic code loading, and other confrontation methods used by malicious samples. Some Android malicious samples that have been discovered so far use dynamic confrontation technology, also known as dynamic evasion technology. For example, Android.Hehe, obad, Pincer family, etc. can evasion dynamic analysis by detecting their own environment. If they detect that they are in a sandbox or dynamic debugging, these malicious samples will not execute malicious behaviors and appear benign. Once these malicious samples use dynamic evasion technology to bypass the defense mechanism we deployed, they can remain in the user terminal stably and obtain income through continuous evil, which will seriously endanger the privacy and property rights of users. Therefore, the research on dynamic evasion technology is very necessary. In this chapter, we will introduce Android dynamic evasion technology and its defense methods. According to the evasion object, Android dynamic evasion technology is mainly divided into two categories: dynamic sandbox evasion and dynamic debugging evasion (Afianian et al., ACM Comput Surv 52(6):1–28, 2019). We will introduce the specific methods of these two categories in Sects. 6.1 and 6.2, respectively. At last, we will introduce the defense methods and related research of dynamic evasion in Sects. 6.3.