On the effectiveness of memory analysis in revealing maliciousness in android applications

Nowadays, Android malware has gained attention due to its ability to infect widely used mobile devices. Typically, current detection approaches rely on static and dynamic techniques to extract several kinds of features, to learn and identify common malicious patterns. However, modern Android malware often exhibits anti-analysis techniques (e.g., obfuscation, environmental checks, and runtime loading) hindering its full identification. To address this problem, we propose RAMimgDroid to analyse and detect malware as soon as it is loaded in memory. Furthermore, RAMimgDroid identifies and presents the analyst with relevant artifacts (e.g. variable declaration with their runtime content, encryption keys), useful to understand the runtime behavior. In detail, we extract the volatile memory allocated by the target process at application startup time. Subsequently, we encode the resulting dump as a 2D/1D RGB/grayscale image and feed it to a CNN for fast detection and identification of the most influential patterns (i.e. pixels and, subsequently, bytes of the dumped RAM). We test RAMimgDroid with 2073 Android malware and 2279 benign samples, assessing the effectiveness of various pre-trained and custom CNNs. Our results demonstrate that RAMimgDroid improves the detection of stealthy Android malware evading traditional detection methods (e.g. obfuscated or with anti-decompilation and environmental checks). Additional experiments on memory dumps acquired later in the malware execution show that RAMimgDroid remains effective even when malware behavior evolves over time (e.g. the malicious routine appears after a time of execution, not immediately at application startup). Moreover, we developed RAMstrDroid to extract the readable UTF-8 characters in the meaningful artifacts from the memory dump, interpreted as Indicator of Compromise (IoC), and compared with popular state-of-the-art tools i.e. VirusTotal and MobSF. The current implementation requires a rooted Android device or emulator and is limited to offline analysis because memory acquisition and image conversion remain too resource-intensive for continuous on-device monitoring.