TriggerZoo: A Dataset of Android Applications Automatically Infected with Logic Bombs

The Android operating system is the most used worldwide in mobile devices (IDC, [n.d.]). Hence, Android security and privacy have become one of the major concerns of researchers. Every year, several thousands of threats are identified by antivirus companies spanning a wide range of maliciousness (e.g., trojan, adware, spyware, ransomware, etc.). To cope with malicious code proliferation, researchers set up several approaches that rely on static analysis (Fereidooni et al., 2016; Kang et al., 2015; Fratantonio et al., 2016; Samhi et al., 2022a), dynamic analysis (Petsas et al., 2014; Van Der Veen et al., 2013; Zheng et al., 2012), machine-learning based analysis (Sahs and Khan, 2012; Peiravian and Zhu, 2013; Daoudi et al., 2021), or hybrid approaches (Xu et al., 2018; Choudhary and Kishore, 2018; Brumley et al., 2008).

Nowadays, malicious developers build their codebase to avoid detection from analyzers (Fratantonio et al., 2016; Samhi et al., 2022b; Berger et al., 2020; Samhi and Bartel, 2021; Dong et al., 2018). A notable technique used to bypass dynamic analyses consists in employing logic bombs that allow the malicious code to be triggered only under specific circumstances (e.g., at a specific date). In recent years, researchers have therefore proposed various techniques to uncover logic bombs in Android applications (apps) (Fratantonio et al., 2016; Samhi et al., 2022b; Pan et al., 2017). However, a common challenge in advancing state of the art is the lack of shared benchmarks for the assessment and fair comparison of literature approaches.

The research literature already proposed various datasets of Android apps to encourage reproducibility and comparison between different approaches. For instance, Allix et al. proposed Androzoo (Allix et al., 2016), a growing repository now including about 18 Million Android apps. Arzt et al. released DroidBench (Arzt et al., 2014), a test suite to evaluate Android taint analysers. Nielebock et al. proposed AndroidCompass (Nielebock et al., 2021) as a dataset of Android compatibility checks. Recently, Wendland et al. (Wendland et al., 2021) released AndroR2, a dataset of bug reports related to Android apps and Li et al. (Li et al., 2021) released AndroCT, a large-scale dataset of runtime traces of benign and malicious Android apps. However, in the research directions related to logic bombs, the community faces a challenge to build a comprehensive dataset due to the known difficulties in detecting logic bombs. Indeed, even if an app is detected as malware, identifying a logic bomb in malware requires extensive manual inspection and strong expertise. Logic bombs are often simple if statements with ”unusual” conditional expressions. Yet, it is far from being trivial to distinguish a ”logic bomb condition” from a ”legitimate and normal condition”. The research community lacks an important artifact in the logic bomb detection domain, i.e., an Android app dataset that contains logic bombs with information about their localization in the apps.

In this work, we propose a new dataset of Android apps containing logic bombs and benign trigger-based behavior to the research community. This dataset, named TriggerZoo, contains 406 apps, from which 240 are infected with logic bombs, and 166 apps contain benign trigger-based behavior. It was generated by applying our dedicated tool, AndroBomb, on 2000 apps from Google Play. TriggerZoo is meant to facilitate research on logic bomb detection. Specifically, TriggerZoo will serve as a base for new approaches to detect logic bombs to assess new tools and compare with other approaches. Besides, since AndroBomb has been developed with a modular approach, it is easy to add new trigger and behavior types.

The main contributions of our work are as follows:

• •

  We propose TriggerZoo, a new reusable dataset of 406 Android apps infected with trigger-based behavior, and their localization with 10 trigger types and 14 behavior types.

• •

  We also propose AndroBomb, an extensible framework to inject trigger-based behaviors into Android apps automatically.

• •

  We provide performance results of two state-of-the-art works Difuzer and TriggerScope on the TriggerZoo dataset.

TriggerZoo apps are made available in the AndroZoo repository, where they are responsibly shared with authenticated researchers only. TriggerZoo apps’ hashes, and labels are available at:

https://github.com/JordanSamhi/TriggerZoo¹¹1DOI: 10.5281/zenodo.5907916, Access: https://doi.org/10.5281/zenodo.5907916

In the same way, and to avoid encouraging malware development, AndroBomb is only available to authenticated researchers. AndroBomb’s instructions and appropriate files are available at:

https://github.com/JordanSamhi/AndroBomb²²2DOI: 10.5281/zenodo.5907924, Access: https://doi.org/10.5281/zenodo.5907924

A logic bomb is a piece of malicious code triggered under very specific circumstances. It means that the malicious code is segregated from the normal execution of the benign code and is only triggered under specific criteria. For instance, if attackers want to target devices in Russia and that have two cameras (i.e., a back and a front one), they can rely on the code illustrated in Listing 1.

Indeed, on line 5, the developer verifies if the device is connected to a Russian mobile network (the ISO-3166-1 alpha-2 country code RU represents the Russian country). On lines 11-13, a photograph is taken from the front camera if the device has at least two cameras and is sent over the network, breaking the user privacy. In this case, the first specific circumstance is that the device is connected to a Russian mobile network (i.e., the Russian population is targeted), and the second one is that the device contains two cameras (i.e., eliminating emulators and old devices.). This example shows that the malicious code is only executed on specific conditions that are unlikely to happen when dynamically analyzing the app in a sandbox. The app’s maliciousness will therefore escape detection.

In the rest of the paper, we refer to trigger type for the type of the condition that triggers the logic bomb or the benign trigger-based behavior (e.g., at a specific time), and to guarded code type for the type of the behavior triggered (e.g., data theft). The interested reader can refer to (Samhi et al., 2022b) for further details on the logic bomb concept.

In this section, we first describe AndroBomb used to construct TriggerZoo. Secondly, we give details about the process we followed to generate our dataset and describe it.

Several state-of-the-art approaches have been proposed to detect logic bombs. TriggerScope was proposed in (Fratantonio et al., 2016) as an automated tool to detect logic bombs. It relies on static analysis techniques such as: symbolic execution, control flow analysis, predicate recovery, and control dependency. Recently, Samhi et al. (Samhi and Bartel, 2021) have released an open-source version of TriggerScope that they named TSOpen. Pan et al. (Pan et al., 2017) proposed HsoMiner, an approach relying on static analysis techniques such as: control flow analysis, backward dependency graph, and trigger analysis. In addition, the authors proposed a machine-learning approach to automatically sort hidden sensitive operations (HSO). Recently, Samhi et al. (Samhi et al., 2022b) proposed Difuzer, an approach to triage logic bombs among suspicious hidden sensitive operations (SHSO). Difuzer relies on instrumentation techniques, taint tracking to identify SHSO entry points and triggers an anomaly detection engine to detect abnormal triggers.

The common points for these approaches are: ❶ they do not assess their tool on existing benchmarks. Hence they cannot measure standard precision, recall, and f-1 score measures; ❷ they cannot compare their respective approach against each other tools. To cope with these limitations, TriggerZoo can be used to measure existing and future tools performances and will allow fair comparison.

In a first attempt to compare state of the art approaches, and to assess TriggerZoo’s usefulness, we executed Difuzer (Samhi et al., 2022b) and TSOpen (Samhi and Bartel, 2021) on the 406 apps present in TriggerZoo to search for logic bombs. Results are available in Table 4. We note that in the original publication of Difuzer, precision and recall metrics were provided based on a-posteriori manual checking, given the lack of benchmark. Thanks to TriggerZoo, comparisons such as the one presented in Table 4 will be readily possible. Furthermore, note that the yielded results, with recall at 58%, suggest that TriggerZoo is ”difficult” and will contribute to challenge future approaches. As a last remark, the a-posteriori comparison results presented in the Difuzer’s paper (Samhi et al., 2022b) are confirmed on the TriggerZoo dataset. Indeed, as shown in Table 4, Difuzer clearly outperforms TriggerScope.

In this paper, we presented two artifacts: ❶ TriggerZoo: a new evolving dataset of Android apps containing logic bombs and benign trigger-based behavior; ❷ AndroBomb: a new framework to infect Android apps with logic bombs and benign trigger-based behavior. TriggerZoo is meant to facilitate future logic bomb detectors assessment and comparison. We also provide results of two state-of-the-art approaches, i.e., Difuzer and TriggerScope, on TriggerZoo, and confirm previous literature results. We believe that the research community will rely on this dataset to propose new approaches to detect logic bombs, thus improving Android apps security and privacy. TriggerZoo is not frozen. It can evolve using AndroBomb to generate new samples with new logic bomb schemes. Both TriggerZoo and AndroBomb serve the community and support the logic bomb detection research direction.

This work was partly supported (1) by the Luxembourg National Research Fund (FNR), under projects Reprocess C21/IS/16344458 the AFR grant 14596679, (2) by the SPARTA project, which has received funding from the European Union’s Horizon 2020 research and innovation program under grant agreement No 830892, (3) by the Luxembourg Ministry of Foreign and European Affairs through their Digital4Development (D4D) portfolio under project LuxWAyS, and (4) by the INTER Mobility project Sleepless@Seattle No 13999722.