Mobile Malware Analysis Subtaxonomy

Version 2.0 March 2016. Part of Mobile Security Taxonomy

Gürol Canbek, Seref Sagiroglu, and Nazife Baykal, 2016. New Comprehensive Taxonomies on Mobile Security and Malware Analysis.
Designed by Gürol Canbek, All Rights Reserved. Contact:
Click the node to scroll to its text representation

Mobile Malware Analysis

Dynamic Analysis a.k.a Behavioral-Based Analysis

Behavior Patterns

Network Signature

Code

Call Graph (Dynamic)

System Calls

Dependency Graph (Dynamic)

Anomaly Detection

Metrics

Network Activity a.k.a Internet Traffic

Battery Consumption

CPU Usage

Memory Usage

Running Processes

OS Operations

File Access

User Device Usage

GUI Interactions

Keyboard

Touchscreen

Communication Frequency

Calls

SMSs

E-mails

Sensor Usage

Scope

On device

Collaborative

Methods

Smoothing Function

Leaky Bucket

Moving Average

Noise Filtering

Data Compression

Time Series Analysis

Temporal Logic of Causal Knowledge (TLCK)

Knowledge-Based Tempral Abstraction (KBTA)

Finite State Machine (FSM)

Pushdown Automata (PDA)

Dynamic Threshold Calculation (DTC)

Classification

Approaches

Expert System

Review Triaging

Methodologies

Whitelisting

Blacklisting

Signature-Based

Heuristic-Based

Rule-Based

Manual

Event Correlation

Statistical

Datasets

Android

Android Malware Genome Project

Contagio Mobile

The Drebin Dataset

AndroTracker

AndroMalShare

Malware.lu

Malwares.com

VirusShare

VirusTotal

Malware Author Tools

Anti-Debug

Anti-Decompile

Anti-Runtime Injection

Anti-Tamper

Encryptor

Obfuscator

Packer

Tamper Detection

Toolkits

Unpacker

VM Detection

Anti-Analysis (Counter Measures)

Obfuscation

Name (class, method, variable, etc)

Code Insertion/Deletion

Code Reordering

Equivalent Code Substitution

Method Inlining

Outline to Method

Method Cloning

Unrolling Loop

Branch Inversion/Flipping

Sensitive API hiding

Flow

Noise

Garbage (Redundant, Junk) instructions a.k.a Dead Code

(Semantic) NOP/NOOP

Unused functions

against Dynamic Analysis

Emulator/Sandbox Detection

Fabricated content recognition

Laying Dormant

Antimalware Detection

Data Encryption in Communication

against Malware Analysis

Anti Reverse Engineering

Anti Decompile

Anti Debug

Packing (compression or encryption)

String

Binary (Dynamic/Runtime Packer)

Class

Asset

Code

Native library

Static Analysis

Binary

Byte N-gram

Code (+Bytecode)

Data Flow Analysis (DFA) a.k.a Taint Propagation

Control Flow Analysis (CFA)

Type Analysis

Symbolic Execution

Points-To Analysis

Structural Analysis

API Calls

Call Graph (Static)

Semantic Analysis

Dependency Graph (Static)

Class Dependency Graph

Function call graph

Entry/Exit Point Analysis

Program Slicing

Analysis Operations

Tracking Malware Authors

Deobfuscating Strings

Self-decoding

Manual programming

Signatures a.k.a Fingerprinting

Hashing

Binary Pattern

Challenges

Common Code on Malicious and Benign Applications

Computation Cost (on Device or on Cloud)

See machine learning problems

Analysts Tools

(Analyse) Sandbox

Data Flow

App Pentest

Debugging

Assembler

Decompiler

Automated Runtime Analyzer

Device Emulator

Binary Analyzer

Dissassembler

Binary Editor

Dynamic Analysis

Control Flow

Firmware Flasher

Call Graph

Forensics Analyzer

IDE

Malware Analysis

Malware Scanner

Malware Scanner Aggregators

Malware Scanner Visualizer

Monkey or Automation

Network packet analyzer

Parser

Virus Scanners (57)

Performance Analyzer

Tools (Android, Java, iOS, Windows) Total 82

Reverse Engineering

Static Analysis

Static Code Analysis

Toolkits

System monitor

Unpacker

Vulnerability Analysis

Anti-Anti-Analysis (Counter Counter Measures)

Anti Emulator Detection

Obfuscation Detection

Entropy Analysis