Analyzing Android Code Graphs against Code Obfuscation and App Hiding Techniques

Malware creators have been very innovative when it comes to creating versions of existing malware to evade detection by anti-malware tools. Obfuscation has been the all-time favorite weapon used in malwares to hide the malicious code from being detected by analysts. These techniques are becoming more complex and sophisticated, and this motivated us to analyze Android code graphs against obfuscation. In this paper, we provide a framework for evaluating code graphs extracted from Android apps against code obfuscation. We have broadened the criteria for evaluation by employing three state-of-the-art obfuscation tools as well as app hiding techniques dedicated to the Android platform. The experimental results show that code graphs can strongly confront single level obfuscation but are vulnerable to multi-level obfuscations. Another finding is that code graphs can detect various techniques of hiding malicious app within a benign app. We also compare the code graph extraction and evaluation methodology with Androguard. This study also serves as a detailed framework for the rigorous evaluation of graph-based features against obfuscation.