@inproceedings{db80d0614dc1467c9073561ac40f93f9,
title = "Dual-force: Understanding webview malware via cross-language forced execution",
abstract = "Modern Android malwares tend to use advanced techniques to cover their malicious behaviors. They usually feature multi-staged, condition-guarded and environment-specific payloads. An increasing number of them utilize WebView, particularly the two-way communications between Java and JavaScript, to evade detection and analysis of existing techniques. We propose Dual-Force, a forced execution technique which simultaneously forces both Java and JavaScript code of WebView applications to execute along various paths without requiring any environment setup or providing any inputs manually. As such, the hidden payloads of WebView malwares are forcefully exposed. The technique features a novel execution model that allows forced execution to suppress exceptions and continue execution. Experimental results show that Dual-Force precisely exposes malicious payload in 119 out of 150 WebView malwares. Compared to the state-of-the-art, Dual-Force can expose 23% more malicious behaviors.",
keywords = "Dynamic analysis, Forced execution, WebView malware",
author = "Zhenhao Tang and Juan Zhai and Minxue Pan and Yousra Aafer and Shiqing Ma and Xiangyu Zhang and Jianhua Zhao",
note = "Funding Information: We thank the anonymous reviewers for their constructive comments. This research is supported, in part, by DARPA under contract FA8650-15-C-7562, NSF under awards 1748764 and 1409668, ONR under contracts N000141410468 and N000141712947, and Sandia National Lab under award 1701331. It is also supported partially by the National Natural Science Foundation of China ?No. 61690204, No. 61632015, No. 6156111146394, No. 61502228?, the National Key R?D Program ?Grant #2016YFB1000802?, the Collaborative Innovation Center of Novel Software Technology and Industrialization, and the Fundamental Research Funds for the Central Universities ?021714380015?. Any opinions, findings, and conclusions in this paper are those of the authors only and do not necessarily reflect the views of our sponsors. Publisher Copyright: {\textcopyright} 2018 Association for Computing Machinery.; 33rd IEEE/ACM International Conference on Automated Software Engineering, ASE 2018 ; Conference date: 03-09-2018 Through 07-09-2018",
year = "2018",
month = sep,
day = "3",
doi = "10.1145/3238147.3238221",
language = "English (US)",
series = "ASE 2018 - Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering",
publisher = "Association for Computing Machinery, Inc",
pages = "714--725",
editor = "Christian Kastner and Marianne Huchard and Gordon Fraser",
booktitle = "ASE 2018 - Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering",
}