During repackaging, malware writers statically inject malcode and modify the control flow to ensure its execution. Repackaged malware is difficult to detect by existing classification techniques, partly because of their behavioral similarities to benign apps. By exploring the app's internal different behaviors, we propose a new Android repackaged malware detection technique based on code heterogeneity analysis. Our solution strategically partitions the code structure of an app into multiple dependence-based regions (subsets of the code). Each region is independently classified on its behavioral features. We point out the security challenges and design choices for partitioning code structures at the class and method level graphs, and present a solution based on multiple dependence relations. We have performed experimental evaluation with over 7,542 Android apps. For repackaged malware, our partition-based detection reduces false negatives (i.e., missed detection) by 30-fold, when compared to the non-partition-based approach. Overall, our approach achieves a false negative rate of 0.35 percent and a false positive rate of 2.97 percent.

中文翻译：

---

检测具有代码异构特性的重新打包的 Android 恶意软件

在重新打包期间，恶意软件编写者静态注入恶意代码并修改控制流以确保其执行。现有的分类技术很难检测到重新打包的恶意软件，部分原因是它们与良性应用程序的行为相似。通过探索应用程序内部的不同行为，我们提出了一种基于代码异质性分析的新的 Android 重新打包恶意软件检测技术。我们的解决方案战略性地将应用程序的代码结构划分为多个基于依赖的区域（代码的子集）。每个区域都根据其行为特征独立分类。我们指出了在类和方法级别图划分代码结构的安全挑战和设计选择，并提出了基于多重依赖关系的解决方案。我们已经对超过 7 个进行了实验评估，542 个安卓应用。对于重新打包的恶意软件，与非基于分区的方法相比，我们基于分区的检测将误报（即漏检）减少了 30 倍。总体而言，我们的方法实现了 0.35% 的假阴性率和 2.97% 的假阳性率。