DroidChameleon

TLDR

Mobile malware threats are a growing concern, and evaluating defenses is essential to gauge current protection and guide next‑generation solutions. The study evaluates commercial Android anti‑malware products for resistance to common obfuscation techniques. The authors developed DroidChameleon, a systematic framework applying various transformation techniques, to conduct the evaluation. None of the ten evaluated Android anti‑malware tools resisted common transformation techniques, which are often simple and poorly addressed, prompting the authors to suggest remedies to improve mobile malware detection.

Abstract

Mobile malware threats have recently become a real concern. In this paper, we evaluate the state-of-the-art commercial mobile antimalware products for Android and test how resistant they are against various common obfuscation techniques (even with known malware). Such an evaluation is important for not only measuring the available defense against mobile malware threats but also proposing effective, next-generation solutions. We developed DroidChameleon, a systematic framework with various transformation techniques, and used it for our study. Our results on ten popular commercial anti-malware applications for Android are worrisome: none of these tools is resistant against common malware transformation techniques. Moreover, the transformations are simple in most cases and anti-malware tools make little effort to provide transformation-resilient detection. Finally, in the light of our results, we propose possible remedies for improving the current state of malware detection on mobile devices.