About MUDFLOW
What is it that makes an app malicious? One important factor is that malicious apps treat sensitive data differently from benign apps. To capture such differences, we mined the top 2,866 benign Android applications for their data flow from sensitive sources, and compare these flows against those found in malicious apps. We find that
- for every sensitive source, the data ends up in a small number of typical sinks;
- these sinks differ considerably between benign and malicious apps;
- these differences can be used to flag malicious apps due to their abnormal data flow;
- malicious apps can be identified by their abnormal data flow alone, without requiring known malware samples.
In our evaluation, our MUDFLOW prototype correctly identified 86.4% of all novel malware, and 90.1% of novel malware leaking sensitive data.
Slides
- "Mining Apps for Anomalies" keynote by Prof. Andreas Zeller at Software Mining Workshop (ASE 2016).
Downloads
The dataset as well as scripts for the statistical analysis are free for use with an obligatory citation of the MUDFLOW paper.