Genetic Analysis of Android Malware

Abstract

With the proliferation of Android malware, the issue of traceability in malware analysis has emerged as a significant problem that requires exploration. By establishing links between newly discovered, unreported malware and prior knowledge from existing malware data pools, security analysts can gain a better understanding of the evolution process of malware and its underlying reasons. However, in real-world scenarios, analyzing the traceability of malware can be complex and time-consuming due to the large volume of existing malware data, requiring extensive manual analysis. Furthermore, the results obtained from such analysis often lack explanation. Therefore, there is a pressing need to develop a comprehensive automated malware tracking system that can provide detailed insights into the tracking and evolution process of malware and offer strong explanatory capabilities. In this paper, we propose a knowledge graph-based approach that uses partial API call graphs comprising semantic and behavioral features to reveal the traceability relations among malware and provide explainable results for these relations. Our approach is implemented on a dataset of over 20,000 malware samples labeled with family information, spanning a time period of 10 years. To address the challenges associated with the complexity of analysis, we leverage prior knowledge from existing malware research and a branch pruning method on call graphs to reduce computational complexity and enhance the precision of explanations when determining traceability relations.