FlowMiner: Automatic Summarization of Library Data-Flow for Malware Analysis

Malware often conceal their malicious behavior by making unscrupulous use of library APIs. Hence any accurate malware analysis must track data-flows not only through the application but also through the library. Libraries like Android 2 mLOC are too large to be analyzed repeatedly with each application, hence we need to compute data-flow summaries of libraries that are expressive enough to reveal possible malicious flows, and compact to be included in malware analysis along with each application.

We present FlowMiner, a novel approach to automatically extract the data-flow summary of a Java library, given its source or bytecode. FlowMiner's summaries are fine-grained, i.e., preserve key artifacts from the original library to enable accurate context, object, field, flow and type-sensitive malware analysis of applications in conjunction with the library. Unlike prior summarization techniques, FlowMiner resolves method calls to anonymous classesto a single target, making it more precise. FlowMiner's summaries are compact, e.g., contain only about a third fourth of the nodes edges, resp. in the data-flow semantics of recent versions of Android. FlowMiner's summaries are stored in XML, allowing any analysis tool to use them for analysis.