Logo image
Back
SeqAdver: Automatic Payload Construction and Injection in Sequence-based Android Adversarial Attack
Abstract

SeqAdver: Automatic Payload Construction and Injection in Sequence-based Android Adversarial Attack

Fei Zhang, Ruitao Feng, Xiaofei Xie, Xiaohong Li and Lianshuan Shi
2023 IEEE International Conference on Data Mining Workshops (ICDMW), pp.1352-1361
2023 IEEE International Conference on Data Mining Workshops (ICDMW) (Shanghai, China, 01/12/2023–04/12/2023)
2023
DOI: https://doi.org/10.1109/ICDMW60847.2023.00172

Metrics

9 Record Views

Abstract

Android malware Payload injection adversarial attack
Machine learning has achieved a great success in the field of Android malware detection. In order to avoid being caught by these ML-based Android malware detection, malware authors are inclined to initiate adversarial sample attacks by tampering with mobile applications. Although machine learning has high capability, it lacks robustness against adversarial attacks. Currently, many of the adversarial attacking tools not only inject dead code into target applications, which can never be executed, but also require the injection of many benign features into a malicious APK. This can be easily noticeable by program analysis techniques. In this paper, we propose SeqAdver, an automatic payload construction and injection tool, which aims to bring the adversarial attack to the next level by injecting a payload that allows execution without breaking the app's original functionalities. These payloads are obtained from benign APKs at the Smali level and normalized into usable code snippets. The extracted Smali codes are carefully selected by filtering out 'user-visible' APIs and Intents. Therefore, payloads are able to be executed without any visible change noticed by the user. Besides, extracted payloads can be injected into different locations of the file based on sequence position or on the launcher class. Experiments were conducted to prove that randomly extracted payloads from benign apps are able to execute without causing any 'user-visible' behaviors or crashing the app when running the app in Android emulators.

Details

Logo image