A Multi-Feature Fusion-Based Obfuscation-Resistant Malware Detection Scheme
This paper proposes TriFuseDroid, a robust Android malware detection scheme that analyzes the impact of code obfuscation on static features and employs a multi-feature fusion network to convert resilient static views into image representations, achieving high accuracy and generalization against diverse obfuscation techniques without requiring obfuscated training samples.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the vast digital ecosystem of the Android operating system, a silent conflict plays out between those who build applications and those who design malicious software to steal data or disrupt devices. To catch these digital intruders, security researchers have long relied on static analysis, a method that examines an application's code without actually running it. They look for specific fingerprints, such as the list of permissions an app requests to access the phone's camera or contacts, the sequence of instructions it follows, and the specific system functions it calls. However, the creators of malicious software have become adept at hiding their tracks. They use a technique called code obfuscation, which scrambles the application's internal structure and renames its components to make the code look like a jumbled mess to a human or a computer program. This constant game of hide-and-seek has rendered many traditional detection methods ineffective, as the very signatures they rely on are altered or erased by these disguises.
A team of researchers at Chongqing University has proposed a new approach to break this stalemate, offering a system that can see through the disguise without needing to see the disguise beforehand. Their work, titled TriFuseDroid, begins not with a new way to run code, but with a deep, systematic investigation into how different types of obfuscation actually affect the specific clues researchers use. They took a large collection of applications and applied eight distinct methods of scrambling them, ranging from simple renaming of variables to complex reordering of the program's logic. By comparing the original, clean code against these scrambled versions, they measured exactly how much each method changed the file size, the similarity of the text, and the structure of the data. They found that while some features, like the list of permissions an app needs, remained almost entirely untouched by the scrambling, others, such as the detailed map of how functions call one another, were completely destroyed or altered beyond recognition.
Armed with this map of vulnerabilities, the researchers designed a detection system that focuses only on the parts of the code that survive the scrambling. They selected three core views of the application: the main executable file, the list of system functions the app uses, and the permissions it requests. Instead of trying to read the raw text of these files, which changes drastically when obfuscated, they converted them into visual representations. They transformed the executable file into a grid of numbers that showed how one piece of data transitioned to the next, creating a unique image that preserved the overall shape of the code even if the individual letters were changed. Similarly, they turned the lists of system functions and permissions into semantic images that captured the meaning of the app's behavior rather than just the specific names of the functions. This process allowed them to create a visual fingerprint that remained stable even when the underlying text was heavily distorted.
The heart of their system is a neural network, a type of computer program inspired by the human brain, designed to look at these three different images simultaneously. The network does not treat them as separate pieces of evidence but fuses them together, learning how the stable permission list, the resilient function calls, and the structural image of the executable file work in concert to identify a threat. This multi-feature fusion allows the system to compensate for weaknesses in any single view; if one image is slightly noisy due to obfuscation, the other two provide the clarity needed to make a correct judgment. The researchers tested this system against a wide variety of scrambled applications, including those that had been subjected to the most aggressive and complex forms of code hiding.
The results showed that this new method significantly outperformed existing techniques. When faced with applications that had been heavily scrambled, older detection systems often failed, dropping their accuracy to levels where they could no longer reliably distinguish between safe and dangerous software. In contrast, the new system maintained a high level of accuracy, correctly identifying the vast majority of malicious applications even when they had been disguised. Crucially, the system achieved this without ever needing to be trained on examples of these specific disguises. It learned to recognize the underlying patterns of malicious behavior that persisted through the scrambling, rather than memorizing specific tricks used by the attackers. This suggests that the approach offers a robust defense against future variations of code obfuscation, providing a more reliable way to keep the digital ecosystem secure without requiring constant updates to the detection software every time a new hiding technique emerges.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.