Effectiveness of Android Obfuscation on Evading Anti-malware

Obfuscation techniques have been conventionally used for legitimate applications, including preventing application reverse engineering, tampering and protecting intellectual property. A malware author could also leverage these benign techniques to hide their malicious intents and evade anti-malware detection. As variants of known malware have been regularly found on the Google Play Store, transformed malware attacks are a real problem that security solutions today need to address. It has been proven that mainstream security tools installed on smartphones are mainly signature-based; our work focuses on evaluating the efficiency of a composite of obfuscation techniques in evading anti-malware detection. We further verified the trend of transformed malware in evading detection, with a larger and more updated database of known malware. This is also the first work to-date that presents the instability of some anti-malware tools (AMTs) against obfuscated malware. This work also proved that current mainstream AMTs do not build up resilience against obfuscation methods, but instead try to update the signature database on created variants.