Automated behavioral and static analysis using an instrumented sandbox and machine learning classification for mobile security
A method comprises, based on receiving a request to analyze at least a first mobile application, scheduling the request for a first sandbox. The first mobile application is analyzed based on the request, wherein the analysis of the first mobile application comprises performing a behavioral analysis of the first mobile application within the first sandbox and performing a static analysis of the first mobile application. A first feature vector is generated based on data resulting from the analysis of the first mobile application. The first mobile application is determined to comprise malware based, at least in part, on comparing the first feature vector with at least a second feature vector, wherein the second feature vector was generated based on at least one of a static analysis and a behavioral analysis of malware.
1. A system comprising:
a processor;
a machine-readable medium having instructions stored thereon, the instructions executable by the processor to cause the system to,
based on receipt of a request to analyze at least a first mobile application, schedule the request for a first sandbox;
perform analysis of the first mobile application based on the request, wherein the instructions to perform the analysis of the first mobile application comprise instructions to perform behavioral analysis of the first mobile application within the first sandbox and perform static analysis of the first mobile application;
generate a first feature vector based on data resulting from the behavioral analysis and the static analysis of the first mobile application; and
determine whether the first mobile application comprises malware based, at least in part, on comparison of the first feature vector with at least a second feature vector, wherein the second feature vector was previously generated based on a static analysis and a behavioral analysis of known malware.
2. The system of claim 1 , further comprising instructions executable by the processor to cause the system to collect log files generated during the analysis of the first mobile application based on the request, wherein the instructions to generate the first feature vector comprise instructions to generate the first feature vector based on extraction of features from the log files.
3. The system of claim 1 , wherein the instructions executable by the processor to cause the system to determine whether the first mobile application comprises malware comprise instructions executable by the processor to cause the system to indicate at least a first predicted behavior of the first mobile application based on the determination.
4. The system of claim 1 , wherein the instructions executable by the processor to cause the system to perform the analysis of the first mobile application based on the request comprise instructions executable by the processor to cause the system to apply one or more risk assessment rules to binary code of the first mobile application during the analysis of the first mobile application based on the request.
5. The system of claim 1 , wherein the first feature vector comprises a behavioral feature and a static feature.
6. The system of claim 1 , wherein the instructions executable by the processor to cause the system to determine whether the first mobile application comprises malware comprise instructions to:
determine if the first feature vector and the second feature vector are sufficiently aligned; and
based on a determination that the first feature vector and the second feature vector are sufficiently aligned, determine that the first mobile application comprises malware.
7. The system of claim 6 , wherein the instructions executable by the processor to cause the system to determine if the first feature vector and the second feature vector are sufficiently aligned comprise instructions executable by the processor to cause the system to determine if a Euclidean distance between the first feature vector and the second feature vector does not exceed a threshold Euclidean distance.
8. The system of claim 1 , wherein the instructions executable by the processor to cause the system to determine whether the first mobile application comprises malware comprise instructions to:
cluster a plurality of feature vectors into at least a first cluster, wherein the plurality of feature vectors was generated based on analysis of a plurality of mobile applications;
based on a determination that a distance between the second feature vector and a centroid of the first cluster satisfies a membership criterion, assign the second feature vector to the first cluster;
determine a distance between the first feature vector and the centroid of the first cluster; and
based on a determination that the distance between the first feature vector and the centroid of the first cluster satisfies a membership criterion, map the first feature vector to the first cluster.
9. A method comprising:
based on receiving a request to analyze a first mobile application, scheduling the request for a first sandbox;
performing an analysis of the first mobile application based on the request, wherein performing the analysis of the first mobile application comprises performing a behavioral analysis of the first mobile application within the first sandbox and performing a static analysis of the first mobile application;
generating a first feature vector based on data resulting from the behavioral analysis and the static analysis of the first mobile application; and
determining that the first mobile application comprises malware based, at least in part, on comparing the first feature vector with at least a second feature vector, wherein the second feature vector was previously generated based on a static analysis and a behavioral analysis of known malware.
10. The method of claim 9 , further comprising collecting log files generated during the analysis of the first mobile application based on the request, wherein generating the first feature vector comprises generating the first feature vector based on extraction of features from the log files.
11. The method of claim 9 , wherein determining that the first mobile application comprises malware comprises indicating at least a first predicted behavior of the first mobile application based on the determining.
12. The method of claim 9 , wherein performing the analysis of the first mobile application based on the request comprises applying one or more risk assessment rules to binary code of the first mobile application during the analysis of the first mobile application.
13. The method of claim 9 , wherein determining that the first mobile application comprises malware comprises:
determining if the first feature vector and the second feature vector are sufficiently aligned; and
based on determining that the first feature vector and the second feature vector are sufficiently aligned, determining that the first mobile application comprises malware.
14. The method of claim 13 , wherein determining if the first feature vector and the second feature vector are sufficiently aligned comprises determining if a Euclidean distance between the first feature vector and the second feature vector does not exceed a threshold Euclidean distance.
15. The method of claim 9 , wherein determining that the first mobile application comprises malware comprises:
clustering a plurality of feature vectors into at least a first cluster, wherein the plurality of feature vectors was generated based on analysis of a plurality of mobile applications;
based on determining that a distance between the second feature vector and a centroid of the first cluster satisfies a membership criterion, assigning the second feature vector to the first cluster;
determining a distance between the first feature vector and the centroid of the first cluster; and
based on determining that the distance between the first feature vector and the centroid of the first cluster satisfies a membership criterion, mapping the first feature vector to the first cluster.
16. The method of claim 9 , wherein the first feature vector comprises a behavioral feature and a static feature.
17. A non-transitory, computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:
based on receiving a request to analyze a first mobile application, scheduling the request for a first sandbox;
performing an analysis of the first mobile application based on the request, wherein performing the analysis of the first mobile application comprises performing a behavioral analysis of the first mobile application within the first sandbox and performing a static analysis of the first mobile application;
generating a first feature vector based on data resulting from the behavioral analysis and the static analysis of the first mobile application; and
determining whether the first mobile application comprises malware based, at least in part, on comparing the first feature vector with at least a second feature vector, wherein the second feature vector was previously generated based on a static analysis and a behavioral analysis of known malware.
18. The non-transitory, computer-readable medium of claim 17 , wherein the operations further comprise collecting log files generated during the behavioral analysis and the static analysis of the first mobile application, wherein generating the first feature vector comprises generating the first feature vector based on extraction of features from the log files.
19. The non-transitory, computer-readable medium of claim 17 , wherein determining whether the first mobile application comprises malware comprises:
determining if the first feature vector and the second feature vector are sufficiently aligned; and
based on determining that the first feature vector and the second feature vector are sufficiently aligned, determining that the first mobile application comprises malware.
20. The non-transitory, computer-readable medium of claim 19 , wherein determining if the first feature vector and the second feature vector are sufficiently aligned comprises determining if a Euclidean distance between the first feature vector and the second feature vector does not exceed a threshold Euclidean distance.