Reply to thread

Message

<blockquote data-quote="tim one" data-source="post: 728648" data-attributes="member: 25920">Signature-based AVs might fail to detect obfuscated APK samples.Many APK malware are obfuscated and use anti-debugging techniques.Such protections not only prevent code inspection/modification, but also uninstall the application if such debugging is detected.Again, sometimes every single string is encrypted with a custom algorithm, basically every reference to a string is replaced by a long array of integers.You get the best detection by using static and dynamic analysis techniques and as said above, static analysis methods using traditional signatures might fail to detect some specific malware.Dynamic analysis detects the behaviour of malicious apps while the app is running so it can detect the behaviour of a malware regardless the signatures.Then talking about the best signatures has just a partial meaning if the Android AV doesn&#039;t use also an effective behavioral/dynamic analysis method.</blockquote>

[QUOTE="tim one, post: 728648, member: 25920"] Signature-based AVs might fail to detect obfuscated APK samples. Many APK malware are obfuscated and use anti-debugging techniques. Such protections not only prevent code inspection/modification, but also uninstall the application if such debugging is detected. Again, sometimes every single string is encrypted with a custom algorithm, basically every reference to a string is replaced by a long array of integers. You get the best detection by using static and dynamic analysis techniques and as said above, static analysis methods using traditional signatures might fail to detect some specific malware. Dynamic analysis detects the behaviour of malicious apps while the app is running so it can detect the behaviour of a malware regardless the signatures. Then talking about the best signatures has just a partial meaning if the Android AV doesn't use also an effective behavioral/dynamic analysis method. [/QUOTE]

Verification