King's College London

Research portal

Euphony: harmonious unification of cacophonous anti-virus vendor labels for Android malware

Research output: Chapter in Book/Report/Conference proceedingConference paper

Médéric Hurier, Guillermo Suarez-Tangil, Santanu Kumar Dash, Tegawendé F Bissyandé, Yves Le Traon, Jacques Klein, Lorenzo Cavallaro

Original languageEnglish
Title of host publicationIEEE International Conference on Mining Software Repositories
DOIs
Publication statusPublished - 20 May 2017

Bibliographical note

small Acceptance Rate: 17%

Documents

  • Euphony: Harmonious Unification of_Accepted22March2017_HURIER_GREEN AAM

    2017msr_euphony.pdf, 552 KB, application/pdf

    30/05/2018

    Accepted author manuscript

    Other

    © 2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

King's Authors

Abstract

Android malware is now pervasive and evolving rapidly. Thousands of malware samples are discovered every day with new models of attacks. The growth of these threats has come hand in hand with the proliferation of collective repositories sharing the latest specimens. Having access to a large number of samples opens new research directions aiming at efficiently vetting apps. However, automatically inferring a reference ground-truth from those repositories is not straightforward and can inadvertently lead to unforeseen misconceptions. On the one hand, samples are often mis-labeled as different parties use distinct naming schemes for the same sample. On the other hand, samples are frequently mis-classified due to conceptual errors made during labeling processes. In this paper, we analyze the associations between all labels given by different vendors and we propose a system called EUPHONY to systematically unify common samples into family groups. The key novelty of our approach is that no a-priori knowledge on malware families is needed. We evaluate our approach using reference datasets and more than 0.4 million additional samples outside of these datasets. Results show that EUPHONY provides competitive performance against the state-of-the-art.

Download statistics

No data available

View graph of relations

© 2018 King's College London | Strand | London WC2R 2LS | England | United Kingdom | Tel +44 (0)20 7836 5454