New software helps identify malicious Android apps

London: Here comes a software that can identify malicious apps which are available on Google Play Store, by checking their behaviour against patterns of known attacks. Named ‘Chabada’, it analyses the description of the app’s functionality that can be read in the app store.   So how does it work? According to the abstract paper, after clustering Android apps by their description topics, the researchers identified outliers in each cluster with respect to their API usage. For instance, “weather” app that sends messages is an anomaly or a “messaging” app that wants to access current location.   The researchers applied this logic on a set 22,500+ Android applications, and Chabada flagged 56 percent of novel malware with such methods, without requiring any known malware patterns.   “Apps whose functionality is described in the app store should behave accordingly. If that is not the case, they are suspect,” said Andreas Zeller, professor of software engineering at Saarland University in Germany who invented this software.   Using programme analysis, Chabada detects which data and services are accessed by the Apps.   With a purpose-built script, they downloaded 150 most popular apps in 30 categories from Google Play Store. ‘Chabada’ then analysed them. Finally, computer scientists investigated the 160 most significant outliers to verify Chabada’s selection.   Downloaded onto a smartphone, the malware installed other programmes which secretly sent text messages to expensive premium services. “In the future, ‘Chabada’ could serve as a kind of gatekeeper, ensuring that malicious apps will never make it into an app store,” explained Zeller.   Google has also already invited Zeller and his colleagues to have Chabada analyse the whole Google App Store.   IANS