#HITBLockdown002 D2T2 - Quark Engine

## Overview

Quark Engine is an Android malware scoring and analysis system developed by Kunu Chen and Jin Wei Sung. Rather than relying on existing cybersecurity approaches, the creators derived their methodology from principles of criminal law, resulting in a novel eight-principle scoring system combined with a Dalvik bytecode loader implementation.

## The Eight Principles

The scoring system is built on principles decoded from criminal law: 1. A malware crime consists of action and targets (similar to criminal definitions) 2. Loss of reputation is greater than loss of wealth (reputation is harder to recover than money) 3. Arithmetic sequence for penalty weighting across crimes 4-6. Order theory comprising three sub-principles: later stages indicate greater certainty of crime practice; more evidence increases penalty weight; proportional sequence (e.g., 2^n) reflects escalating severity 7. Crimes are treated as independent events allowing direct penalty addition 8. Threshold generation system to classify threat levels

## Android Malware Crime Order Theory

The core innovation is a five-stage theory mirroring criminal law stages (determination, conspiracy, preparation, start, practice): - **Stage 1**: Check if malware requests related permissions - **Stage 2**: Verify if key native APIs are called - **Stage 3**: Detect specific API combinations - **Stage 4**: Confirm APIs are called in correct sequence by tracing mutual parent functions - **Stage 5**: Verify APIs handle the same register through CPU operation simulation

## Technical Implementation

The Dalvik bytecode loader implements all five stages. Stage 4 overcomes obfuscation by tracing function call hierarchies regardless of renamed wrappers. Stage 5 uses a custom "register object" data type storing register name, current value, and which functions access it. The engine simulates CPU operations line-by-line, maintaining a hash table history of register states to track data flow between APIs.

## Real-World Analysis

Two malware cases were demonstrated: 1. Non-obfuscated malware stealing location data via SMS with clear function names (send_message, get_location) containing native APIs get_cell_location and send_text_message 2. Obfuscated malware detecting Wi-Fi hotspots using get_active_network_info and get_cell_location APIs, with intentionally renamed functions (p.a, am.a, etc.) that still traced back to legitimate behavior patterns

## Detection Rule Generation

To scale rule creation beyond human capacity, a seven-step automated strategy was developed: 1. Crawl official Android API documentation 2. Ignore permissions in initial engine scan 3. Generate all possible API combination rules 4. Find first-stage verified rules matching actual malware 5. Add permission context from matched malware 6. Verify second-stage rules and count malware matches 7. Sort and review rules by prevalence

This approach reduces resource consumption versus generating all 1.26×10^13 possible combinations.

## Takeaways

Quark Engine provides malware analysts with structured confidence levels (0-100% based on stage evidence) for behavioral detection, enables rapid analysis of obfuscated code, and automates rule generation. Future work includes handling native libraries (.so files), packed APKs, API version changes across Android versions, and potentially replacing the currently-inactive Andrew Guard core library.