ADBuilder: uma ferramenta de construção de datasets para detecção de malwares Android

Abstract

The importance of accurate and effective datasets for tools that perform analysis of malware and Android operating system is crucial. Through an investigation, the need for more efficient solutions in this area was identified. With this purpose in mind, the automated construction of datasets was proposed, which integrates processes such as automated APK downloading, feature extraction, app labeling, data cleaning, and final dataset generation, forming the ADBuilder tool. The tool architecture is based on 4 (four) independent and weakly coupled modules, following the producer-consumer principle, that communicate through queues. Through initial studies, the feasibility of the tool implementation was verified and the first two modules, downloading and extraction, were developed. The download module was implemented using the AndroZoo repository, to obtain Android apps quickly and efficiently. The extraction module was carried out using the Androguard tool, which is capable of extracting the features of an Android app. The results obtained showed that the integration of the first two modules had satisfactory results, with the expected functionality of downloading an app and extracting its features. Therefore, the results of this research were promising and validated the implementation of the subsequent modules of the ADBuilder tool, namely the labeling module and the generation module. The implementation of these modules demonstrated efficiency in obtaining the labeling data of the analyzed applications, through the VirusTotal service, and creating the final dataset. Through these results, it was proven that ADBuilder is capable of successfully integrating the application labeling processes, data cleaning, and final dataset generation. The comparison with Drebin-215 dataset highlighted the breadth and quantity of features extracted by ADBuilder, reinforcing its ability to comprehensively describe the behavior of malicious applications. These results validate the importance of ADBuilder as an efficient tool for the analysis and detection of Android malware, driving future advancements and enhancements in this field.