Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART
summary
Malton implements on-device ART instrumentation to monitor Java, native, JNI and reflection crossings without repackaging target apps, and it records method invocations, memory reads/writes and network/storage ops. It adds shadow memory taint tracking to follow sensitive values across layers and uses concolic execution with desktop solver plus occasional direct execution to generate inputs for unexplored paths. Evaluated on real malware, Malton extracts 14 distinct remote-control commands and their triggered payloads and finds a behavior in 15 samples where an emulator-based tool finds only one.
AI-written summary · about
chapters (8)
- 0:00Introduction to malware
- 1:21Current analysis challenges
- 5:05Mountain framework design
- 9:38Architectural components
- 14:13Behavior monitoring models
- 17:52Implementation and execution
- 23:44Experimental evaluation
- 27:01Conclusion and Q&A
related talks
48mA Novel Runtime Technique For Identifying Malicious Applications
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
18mMac-A-Mal: An Automated Platform for Mac Malware Hunting
53mAndroid: He protec, but he also attac
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
29mA Day in the Life of a Mobile Malware Reverse Engineer
41mAndroid malware forensics
33mWhen Attackers Go Mobile-First with AI