APKLancet: tumor payload diagnosis and purification for android applications

A huge number of Android applications are bundled with relatively independent modules either during the development or by intentionally repackaging. Undesirable behaviors such as stealthily acquiring and distributing user's private information are frequently discovered in some bundled third-party modules, i.e., advertising libraries or malicious code (we call the module tumor payload in this work), which sabotage the integrity of the original app and lie as a threat to both the security of mobile system and the user's privacy.

In this paper, we discuss how to purify an Android APK by resecting the tumor payload. Our work is based on two observations: 1) the tumor payload has its own characteristics, so it could be spotted through program analysis, and 2) the tumor payload is a relatively independent module so it can be resected without affecting the original app's function.

We propose APKLancet, an automatic Android application diagnosis and purification system, to detect and resect the tumor payload. Relying on features extracting from ad libraries, analytics plugins and an approximately 8,000 malware samples, APKLancet is capable of diagnosing an APK and discovering unwelcome code fragment. Then it makes use of the code fragment as index to employ fine-grained program analysis and detaches the entire tumor payload. More precisely, it conducts an automatic app patching process to preserve the original normal functions while resecting tumor payload. We test APKLancet by the Android apps bundled with representative tumor payloads from online sandbox system. The result shows that the purification process is feasible to resect tumor payload and repair the apps. Moreover, all of the above do not require any Android system modification, and the purified app does not introduce any performance latency.