모바일 게임용 안드로이드 에뮬레이터 탐지 기법
Detecting Android Emulators for Mobile Games
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
많은 게임 앱이나 금융 앱들의 경우, 동적 역공학 공격을 방어하기 위해 에뮬레이터 탐지 기능을 탑재하고있다. 그러나 기존 안드로이드 에뮬레이터 탐지 방법들은, 실제 기기와 유사해진 최신 모바일 게임용 에뮬레이터를 탐지하는데 한계가 있다. 이에 본 논문에서는 Houdini 모듈과 라이브러리 문자열 기반으로 모바일 게임용 에뮬레이터를 효과적으로 탐지하는 기법을 제안한다. 구체적으로, bionic의 libc 라이브러리에 포함된 특정 문자열, Houdini 관련된 시스템 콜 수행과정 분석과 메모리 매핑을 통해, 잘 알려진 Nox와 LD Player 에뮬레이터를 탐지하는 기법을 제시한다.
Abstract
Many game and financial apps have emulator detection functionality to defend against dynamic reverse engineering attacks. However, existing Android emulator detection methods have limitations in detecting the latest mobile game emulators that are similar to actual devices. Therefore, in this paper, we propose a method to effectively detect Android emulators for mobile games based on Houdini module and strings of a library. The proposed method detects the two emulators, Nox and LD Player through specific strings included in libc.so of bionic, and an analysis of the system call execution process and memory mapping associated with the Houdini module.
참고문헌 (23)
- "AVD User guide"[URL]
- Jyoti Gajrani, "A robust dynamic analysis system preventing SandBox detection by Android malware", Proceedings of the 8th International Conference on Security of Information and Networks (2015)
- "Combating Potentially Harmful Applications with Machine Learning at Google: Datasets and Models"[URL]
- 남우환, "안드로이드 에뮬레이터에 대한 포렌식 기법", 디지털포렌식연구, 13(4), pp.303~316 (2019), 한국디지털포렌식학회[DOI]
- 윤종성, "모바일 게임 보안을 위한 안드로이드 에뮬레이터 탐지방법에 관한 연구", 정보보호학회논문지, 25(5), pp.1067~1075 (2015), 한국정보보호학회[DOI]
- "Mobile Game cheats :Game Bot News"[URL]
- "“Evil mobile emulator farms”used to steal millions from US and EU banks"[URL]
- Ye Roger, "Android System Programming:Porting, customizing, and debugging Android HAL", Packt Publishing
- "Houdini module"[URL]
- Thanasis Petsas, "Rage against the virtual machine: Hindering dynamic analysis of android malware", Proceedings of the Seventh European Workshop on System Security, pp.5:1~5:6 (2014)
- Onur Sahin, "Research in Attacks, Intrusions, and Defenses", pp.3~24 (2018)
- "Nox App Player Download for Windows PC, Mac, Laptop" (2016)[URL]
- "A highly-customizable free emulator"[URL]
- "android-x86 download"[URL]
- Qifan Yang, "Mobile Gaming on Personal Computers with Direct Android Emulation", Proceedings of The 25th Annual International Conference on Mobile Computing and Networking, pp.1~15 (2019)
- Hwa-Young Jeong, "x86-Android performance improvement for x86 smart mobile devices", Concurrency and Computation: Practice and Experience, 28(10), pp.2770~2780 (2016), Wiley[DOI]
- Timothy Vidas, "Evading android runtime analysis via sandbox detection", Proceedings of the 9th ACM symposium on Information, computer and communications security, pp.1~6 (2014)
- Jie Lin, "Out-of-Domain Characteristic Based Hierarchical Emulator Detection for Mobile", Proceedings of the 2nd International Conference on Information Technologies and Electrical Engineering, pp.1~5 (2019)
- Daehee Jang, "Rethinking anti-emulation techniques for large-scale software deployment", Computers & Security, 83, pp.182~200 (2019), Elsevier BV[DOI]
- Yiming Jing, "Morpheus: automatically generating heuristics to detect android emulators", Proceedings of the 30th Annual Computer Security Applications Conference, pp.216~225 (2014)
- "AWS Device Farm device list"[URL]
- Sora Lee, "Android Emulator Detection for Evading Dynamic Analysis", Proceedings of the Korean Information Science Society Conference, pp.846~848 (2015)
- Namsu Kim, "Detecting Android Emulators based on API calls: Overview and Research Trends", Proceedings of the Spring Annual Conference of Korea Institute of Next Generation Computing (2020)