DLCDroid an android apps analysis framework to analyse the dynamically loaded code

Area of Science:

• Computer Science
• Software Engineering
• Cybersecurity

Background:

• Dynamically Loaded Code (DLC) allows Android apps to expand functionality at runtime, but malicious actors exploit this for malware.
• Existing static analysis tools struggle to detect data breaches caused by DLC in anti-emulated environments.
• Conventional methods are insufficient for identifying sophisticated threats leveraging dynamic code loading.

Purpose of the Study:

• Introduce DLCDroid, an Android app analysis framework designed to combat dynamically loaded code.
• Enhance the detection of information leaks and malicious behavior hidden by DLC techniques.
• Improve the scalability and automation of Android malware analysis.

Main Methods:

• DLCDroid employs the reflection API and dynamic code interposition for API hooking to analyze app behavior.
• Combines static and dynamic analysis techniques to uncover concealed malicious activities.
• Integrates an event-based trigger solution for automated and scalable analysis.

Main Results:

• DLCDroid significantly improves the detection of sensitive information leaks caused by reflection API, achieving over 95.6% accuracy.
• Effectively identifies suspicious behavior missed by static analysis alone.
• Demonstrates superior performance compared to state-of-the-art approaches in detecting DLC-related threats.

Conclusions:

• DLCDroid provides a robust solution for analyzing dynamically loaded code in Android applications.
• The framework enhances the detection of sophisticated malware by exposing hidden malicious behavior.
• DLCDroid offers a scalable and automated approach to mobile app security analysis.