How Machine Learning Finds Malware Needles in an App Store Haystack
Veracode VP Theodora Titonis demonstrates using supervised machine learning algorithms to automatically detect malicious Android applications at scale.
Summary
The Scalability Challenge of App Store Triage
With hundreds of thousands of new mobile applications released monthly, manual security audits and static signature checks fail to keep pace.
Extracting Behavioral and Static Feature Vectors
Theodora Titonis explains parsing Android APK manifests, API call graphs, requested permission combinations, and control-flow graphs into structured feature vectors.
Training Classifiers for Malware Identification
Titonis compares Random Forest, Support Vector Machine (SVM), and clustering algorithms trained on known malicious and benign app datasets.
Achieving High Precision and Reducing False Positives
The author discusses optimizing classifier thresholds and combining static ML heuristics with dynamic sandbox detonation.
Related talks
Red Team Village·15 min
Ibad Shah
Ibad Shah shares the journey of discovering critical flaws in a million-user Android app, navigating vendor communication, and executing coordinated vulnerability disclosure.
Village Presentations·47 min
Sam Bowne
City College professor Sam Bowne demonstrates auditing Android apps for OWASP Mobile Top 10 flaws using APK decompilation and traffic interception.
Briefings·41 min
Ben Nassi · Or Yair · Stav Cohen
Researchers uncover indirect prompt injection attack surfaces in workspace agents, demonstrating unauthorized cross-application data extraction.