PIEDChecker: Uncover Permissions-Independent Emulation-Detection Methods in Android System

For compatibility checks and preventing malicious cheating behaviors in Android systems, It is convenient for benign app developers to utilize emulation-detection technology. However, this technique has been abused by malicious app developers, which causes detection emulation and behavior change, known as anti-emulation behavior, to evade the dynamic analysis performed via the Android emulator. The Android permission mechanism can limit some anti-emulation behaviors, but attackers can still use permission-independent (PI) emulation-detection technology to achieve their goals. In this paper, we propose a static and dynamic combined detection framework named PIEDChecker to detect PI emulation-detection apps. This framework can statically identify PI emulation-detection code and dynamically verify PI anti-emulation behaviors. PIEDChecker's performance is validated by 382 manually created test apps and 344 apps with emulation-detection labels. Moreover, PIEDChecker has higher accuracy in detecting PI emulation-detection compared with the existing Android malware analysis platforms and academic methods. Moreover, it is found that there are 13,377 apps having PI emulation-detection behaviors within the tested 25,303 apps collected over the past five years. In particular, the detection features of the PI emulation-detection methods are summarized based on the evaluation result.