[Paper Review] Sound and Precise Malware Analysis for Android via Pushdown Reachability and Entry-Point Saturation

Shuying Liang, Andrew W. Keep+5 more|arXiv (Cornell University)|Nov 17, 2013

Advanced Malware Detection Techniques26 references4 citations

TL;DR

This paper presents Anadroid, a sound and precise static malware analysis framework for Android apps that combines pushdown control-flow analysis (PDCFA) for accurate interprocedural and exception-driven control-flow modeling with Entry-Point Saturation (EPS) to soundly handle asynchronous, multi-entry point execution. The approach achieves 95% accuracy in malware detection and reduces human-plus-machine analysis time from 85 to 35 minutes per app, significantly outperforming traditional finite-state methods.

ABSTRACT

We present Anadroid, a static malware analysis framework for Android apps. Anadroid exploits two techniques to soundly raise precision: (1) it uses a pushdown system to precisely model dynamically dispatched interprocedural and exception-driven control-flow; (2) it uses Entry-Point Saturation (EPS) to soundly approximate all possible interleavings of asynchronous entry points in Android applications. (It also integrates static taint-flow analysis and least permissions analysis to expand the class of malicious behaviors which it can catch.) Anadroid provides rich user interface support for human analysts which must ultimately rule on the "maliciousness" of a behavior. To demonstrate the effectiveness of Anadroid's malware analysis, we had teams of analysts analyze a challenge suite of 52 Android applications released as part of the Auto- mated Program Analysis for Cybersecurity (APAC) DARPA program. The first team analyzed the apps using a ver- sion of Anadroid that uses traditional (finite-state-machine-based) control-flow-analysis found in existing malware analysis tools; the second team analyzed the apps using a version of Anadroid that uses our enhanced pushdown-based control-flow-analysis. We measured machine analysis time, human analyst time, and their accuracy in flagging malicious applications. With pushdown analysis, we found statistically significant (p < 0.05) decreases in time: from 85 minutes per app to 35 minutes per app in human plus machine analysis time; and statistically significant (p < 0.05) increases in accuracy with the pushdown-driven analyzer: from 71% correct identification to 95% correct identification.

Motivation & Objective

• Address the challenge of sound and precise static analysis in object-oriented, dynamically dispatched Android applications with complex control and exception flows.
• Overcome the imprecision and unsoundness of traditional finite-state control-flow analysis in modeling stack-based and exception-driven control transfers.
• Provide a scalable, sound technique to model interleaved execution of multiple asynchronous entry points in Android apps, a key challenge in Android malware detection.
• Integrate taint and least-permissions analysis to detect sensitive data leaks and permission abuse, enhancing detection of malicious behaviors.
• Enable human-in-the-loop analysis through a rich UI and user-defined predicates for targeted inspection of suspicious behaviors.

Proposed method

• Employ pushdown control-flow analysis (PDCFA) to model interprocedural control and exception flows precisely by tracking call-return and exception-handling contexts using a pushdown stack.
• Introduce Entry-Point Saturation (EPS) to soundly approximate all possible interleavings of asynchronous entry points by iteratively expanding the set of reachable entry points under all possible execution orders.
• Integrate PDCFA with static taint-flow analysis to track sensitive data propagation across method calls and control-flow paths.
• Combine least-permissions analysis using a permission map from PScout to detect apps requesting more permissions than necessary.
• Design a user interface that allows analysts to define custom predicates to filter and highlight suspicious behaviors for deeper inspection.
• Implement the framework on Dalvik bytecode and evaluate it using a DARPA APAC challenge suite of 52 Android apps.

Experimental results

Research questions

• RQ1 Can pushdown control-flow analysis improve the precision and soundness of static analysis for object-oriented Android applications compared to finite-state abstractions?
• RQ2 Can Entry-Point Saturation (EPS) provide a sound and scalable approximation of interleaved execution across multiple asynchronous entry points in Android apps?
• RQ3 Does combining PDCFA and EPS lead to measurable improvements in malware detection accuracy and analysis efficiency?
• RQ4 To what extent can human-in-the-loop analysis with user-defined predicates enhance the detection of sophisticated, obfuscated malware?
• RQ5 How does the performance and accuracy of Anadroid compare to traditional static analysis tools relying on finite-state control-flow models?

Key findings

• The use of pushdown control-flow analysis (PDCFA) reduced human-plus-machine analysis time from 85 minutes to 35 minutes per app, a statistically significant improvement (p < 0.05).
• Malware detection accuracy increased from 71% to 95% when using the PDCFA-enabled version of Anadroid, representing a statistically significant improvement (p < 0.05).
• The integration of Entry-Point Saturation (EPS) enabled sound modeling of asynchronous, multi-entry point execution, avoiding the unsound path pruning common in existing tools.
• The combination of PDCFA and EPS allowed Anadroid to precisely model exception flows and complex control transfers that finite-state models fail to distinguish.
• The framework successfully detected both confidentiality violations and permission abuse, including cases where unprivileged apps exploited privileged components.
• The tool’s user interface with predicate-based filtering enabled analysts to efficiently inspect deeply obfuscated malware behaviors, improving practical usability in real-world analysis.