hgascon / adagio

Structural Analysis and Detection of Android Malware

adagio

Structural Analysis and Detection of Android Malware

Adagio contains several modules that implement the method described in the paper:

Structural Detection of Android Malware using Embedded Call Graphs
Hugo Gascon, Fabian Yamaguchi, Daniel Arp, Konrad Rieck
ACM Workshop on Security and Artificial Intelligence (AISEC) November 2013

These modules allow to extract and label the call graphs from a series of Android APKs or DEX files and apply an explicit feature map that captures their structural relationships. The analysis module provides classes to desing a binary or multiclass classification experiment using the vectorial representation and support vector machines.

adagio's Issues

Error starting the analysis

Hello, I want to use Adagio to do some call graphs analysis and I run the following command:

$ ./adagio.py -f -d clean_dir/

The directory clean_dir/ contains a couple of benign .apk files. But I always get the following errors:

[] Loading /datadisk/Workspace/adagio/clean_dir/waze.apk                             ] ETA:  --:--:-- 
[*] NameError error loading /datadisk/Workspace/adagio/clean_dir/waze.apk
[] Loading /datadisk/Workspace/adagio/clean_dir/com.android.vending_10.6.08-all_0_PR_200628961-81060800_minAPI16_apkmirror.com.apk
[*] NameError error loading /datadisk/Workspace/adagio/clean_dir/com.android.vending_10.6.08-all_0_PR_200628961-81060800_minAPI16_apkmirror.com.apk
[] Loading /datadisk/Workspace/adagio/clean_dir/com.google.android.music_8.13.7350-3.G-73503_minAPI21_apkmirror.com.apk
[*] NameError error loading /datadisk/Workspace/adagio/clean_dir/com.google.android.music_8.13.7350-3.G-73503_minAPI21_apkmirror.com.apk
Building graphs: 100% [###############################################################################] Time: 0:00:00 
Done.

I tried cleaning up the names to something very simple like the first .apk named waze.apk but I still get the name error. Can you help me with this error message? Am I doing something wrong when instantiating the process?

AttributeError error while runnig the project

Hello,
Im trying for few days to run this project on different apps apks files, and everytime i got this error message.
In addition its creates an AttributeError folder which contain the exact apk file, could you help me to figure out the problem?

Improve documentation

What is FCGextractor? How to use?

Where can i get FCGextractor?

Have some problems

Hi,dear hgascon,I have some problems when I use adagio.
First,I use adagio.py but the output files are not end with fcg.But in adagio.core.Analysis.read_files,it only can deal with files end with fcg.
Second,I add fcg extension to the files but it gots some erro:

a = Analysis(["benign/","malware/"],labels=[1,0],split=0.8)
Loading samples in dir benign/ with label 1
0%| | 0/2 [00:00<?, ?it/s]'DiGraph' object has no attribute 'neighbors_iter'
err: benign/b3d5166e6dccd4f81d8409582dba5cad3b58b78540ebfe8475a5e90823148335.fcg
.
.
.

Every files have this erro,how can i fix it?

And what the python version is?

Thank u very much if u can give me some help!

No FCGextractor.py

I have installed all dependencies (Androguard, scikit-learn and Networkx). When I tried to use adagio I couldn't find file FCGextractor.py described on the usage document. Can you provide detailed instruction on how to run the tool?

Thanks!

Store ROC results in epg or pdf vectorial files instead of pngs

This is done in the analysis module after an experiment is completed.

How to run this project ?

I have installed all the dependencies and can start the project by "adagio.py".
But when I finished this command and use iPython as http://adagio.readthedocs.org/ said, I found problems at first step.
Could you give a updated introduction to tell us how to run this project ?

How to implement androguard for adagio?

I have put the androguard main folder into "modules" folder of adagio, while I couldn't make adagio run because I got the error "ImportError: No module named androguard.androlyze"

So what is the correct way to import androguard? from my knowledge, there is no way to install androguard from python pip. BTW, since the google code site was abandoned by androguard team, the only way to download androguard is throug Github.

How to compute aggregated weight of each bin of the histogram?

In your paper

you've mentioned in section 2.4 that:

In order to identify what substructures of Gh contribute
to this decision, it is necessary to reverse the expansion performed
in Eq. (5). In particular, we compute an aggregated
weight ˆwi for each bin i of the histogram (corresponding to
the i hash value of the graph Gh). Formally, this is achieved
for the i-th bin of the histogram as follows

But I still don't know how to compute this aggregated weigtht

Could you please explain it in details?

Classification process

Hi Hugo,
Regarding Adagio, do you remember how to run the classification process on the extracted graphs?
I extracted the graphs using the -f/-p flags. However, there is no documentation how to actually run the train and test of an ML on these graphs. I assume that the common directory holds the functions, but I don't find the sequence.
I will be happy if you can add some instructions/script on this matter.

How to use the adagio.py to process apk set？

Hello @hgascon , I have put some apk files in the folder "/home/cfy/Documents/20malware/",and then I made use of command:python adagio.py -d /home/cfy/Documents/20malware/ -f . But I got an error:
File "/usr/lib/python2.7/gzip.py", line 94, in init
fileobj = self.myfileobj = builtin.open(filename, mode or 'rb')
IOError: [Errno 2] No such file or directory: '/home/cfy/Documents/adagio/data/fcg/71d0c743325e97561e835e7f7d6f605ea48bc96389bd760f078347b5c61ad6c9.pz'

Therefore,I suspect the type of files make mistake.