Title
DexMonitor: Dynamically Analyzing and Monitoring Obfuscated Android Applications.
Abstract
Both Android application developers and malware authors use sophisticated obfuscation tools to prevent their mobile applications from being repackaged and analyzed. These tools obfuscate sensitive strings and classes, API calls, and control flows in the Dalvik bytecode. Consequently, it is inevitable for the security analysts to spend the significant amount of time for understanding the robustness of these obfuscation techniques and fully comprehending the intentions of each application. Since such analyses are often error-prone and require extensive analysis experience, it is critical to explore a novel approach to systematically analyzeAndroid application bytecode. In this paper, we propose an approach to address such a critical challenge by placing hooks in the Dalvik virtual machine at the point where a Dalvik instruction is about to be executed. Also, we demonstrate the effectiveness of our approach through case studies on real-world applications with our prototype called DexMonitor.
Year
DOI
Venue
2018
10.1109/ACCESS.2018.2881699
IEEE ACCESS
Keywords
Field
DocType
Bytecode monitoring,Android application analysis,mobile security
Virtual machine,Android (operating system),Computer science,Robustness (computer science),Encryption,Malware,Obfuscation,Bytecode,Java,Operating system,Distributed computing
Journal
Volume
ISSN
Citations 
6
2169-3536
0
PageRank 
References 
Authors
0.34
0
3
Name
Order
Citations
PageRank
haehyun cho1166.55
Jeong Hyun Yi234627.06
Gail-Joon Ahn33012203.39