ANDROMAK

Android is now the most used operating system with 86% market shares. Thanks to an active developer community, the application ecosystem gets bigger everyday. For example, Google Play Store holds 3.3 million applications with a rate of more than 50–000 submissions a month. Estimations indicate that more than 75 billions applications were downloaded on the platform in 2016. Consequently, due to its widespread popularity, the Android platform has become a lucrative target for hackers.

Hence Android constitutes one of the first choice platform to propagate malware threats. Infection rate on Android devices  is  constantly  increasing  spawned  out  by  a  dramatic  proliferation  of  malware.
Nowadays  there  are  no  satisfactory  solutions  to  stop  the  proliferation  of malware over Android devices. It constitutes a severe threat to any businesses. It may interrupts  and  disables  applications,  retrieved  and  spoofed  personal  information  and identity, access sensitive information, control all applications executing on users’ device, and even overcharge users for functionality that’s widely available. This thesis has two main objectives:

1. Evaluating  the  true  robustness  of  anti-malware  scanners  through  the  design  of  benchmarks and  key  indicators  with  the  use  of  innovative  measurements  techniques  based  on  generative adversarial networks. To automate the robustness evaluation of anti-malware scanners against the steady increase of malware variants, we propose to generate Android adversarial examples (AAEs) dedicated to Android based on generative adversarial networks (GANs) techniques. The robustness is evaluated in terms of performance degradation  of  scanners.  One  underlying  purpose  is  to  demonstrate  the  strong  inability  of  existing scanners to detect sophisticated malware that have mutated. So far, few attempts have been done to generate AAEs for Android. Most of them (16; 6; 7) are only altering basic features without altering the malware bytecode reducing so drastically both its applicability and its interest.
2. Providing the next generation on devices anti-malware protection to overcome the shortcomings of existing state of the art solutions from both the academia and the industry. A scanner has to extract a vector of features from Android applications. To this end, two main techniques are mainly used : static and dynamic analysis. Static analysis (11) consists in analyzing application source code without running it. Although this technique is the most widespread, it is inefficient as soon as advanced obfuscation tactics are used. The dynamic analysis technique also called either tracing or profiling  (4)  comes  as  a  solution  to  these  limitations  and  consists  in  analyzing  the  actual  behavior of applications during their execution. However, they are not without shortcomings either. Dynamic analysis based scanners are realized in-lab, mostly for performance reasons as it drastically impact users’ interactions, and for scaling purposes (13). However, advanced malware may strongly bypass scanners detection. They can hide their malicious behavior by detecting the in-lab environment.
   To overcome these shortcoming, we propose to design a new approach to perform efficient application profiling on device through a novel code instrumentation approach that we call indirect instrumentation.