• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.3
• /
• pp.519-529
• /
• 2019

Nowadays, intelligent Android malware applies anti-analysis techniques to hide malicious behaviors and make it difficult for anti-virus vendors to detect its presence. Malware can use background components to hide harmful operations, use activity-alias to get around with automation script, or wipe the logcat to avoid forensics. During our study, several static analysis tools can not extract these hidden components like main activity, and dynamic analysis tools also have problem with code coverage due to partial execution of android malware. In this paper, we design and implement a system to analyze intelligent malware that uses anti-analysis techniques to improve detection rate of evasive malware. It extracts the hidden components of malware, runs background components like service, and generates all the intent events defined in the app. We also implemented a real-time logging system that uses modified logcat to block deleting logs from malware. As a result, we improve detection rate from 70.9% to 89.6% comparing other container based dynamic analysis platform with proposed system.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2016.04a
• /
• pp.482-485
• /
• 2016

안드로이드 애플리케이션의 UI 테스팅에서 무반응 문제의 탐색과 제거는 매우 중요하다. ANR(Application Not Responding)은 애플리케이션이 일정 시간 동안 응답이 없는 상태로, 내부적으로 어떤 스레드의 처리에 많은 시간이 소요될 경우 UI 스레드가 반응을 하지 않는 상황을 말한다. 안드로이드 플랫폼은 ANR 문제점 해결을 위해 DDMS와 Logcat과 같은 다양한 디버깅 도구들을 지원한다. 하지만 이러한 방법들은 ANR이 발생한 후에 대처하는 방법이므로 발생하기 전 ANR이 일어날 곳을 미리 탐색하고 회피하는 방법이 필요하다. 이 논문에서는 ANR이 발생하는 지점을 찾고 수정하여 프로세스가 원활한 응답성을 유지할 수 있도록 하였다. 그러기 위해 안드로이드 APK 파일을 추출하여 수행될 메시지를 포함하고 있는 인텐트 흐름 경로를 분석하여야 한다. 실행되는 응용 프로그램의 데이터 흐름과 응답시간 측정을 통하여 ANR이 발생 가능한 곳을 효율적으로 탐색할 수 있음을 보였다.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.11
• /
• pp.101-105
• /
• 2012

Various social problems through violating personal information and privacy are growing with the rapid spread of smartphones. For this reason, variety of researches and technology developments to protect personal information being made. The smartphone, contains almost all of the personal information, can cause data spill at any time. Collecting or analyzing evidence is not an easy job with forensic analyzing tool. Android forensics research has been focused on techniques to collect and analyze data from non-volatile memory but research for volatile data is very slight. Android log is the non-volatile data that can be collected by volatile storage. It is enough to use as a material to track the usage of the Android phone because all of the recent driven records from system to application are stored. In this paper, we propose a method to respond to determining the existence of personal information leakage by filtering logs without forensic analysis tools.