Feature List is the necessary artifact to reproduce our method. We collected a total of 132 features, including 37 string features, 45 file features, and 50 numerical features.
- String features refer to features that can be used to detect the emulator by checking if certain attributes match specific strings. These features include build properties, CPU names, and QEMU properties. For instance, if build.model equals string sdk, we can determine that the device is running on an emulator.
- File features can be used to detect emulators by determining whether specific file paths exist, including root-related paths, x86 file-related paths, and QEMU-related paths.
- Numerical features can be used to detect emulators by examining their numerical distribution, including the number of installed packages and sensors, the maximum and minimum values of the sensor within a fixed time, and the time when it no longer changes. We chose the last feature because the sensor data from the emulator is generated by a random number generation algorithm, which generally uses a normal distribution. In this case, the feature will be maximized within a certain time range, but this phenomenon does not occur in phones.
- T. Vidas and N. Christin, “Evading android runtime analysis via sandbox detection,” in 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS ’14, Kyoto, Japan - June 03 - 06, 2014. ACM, 2014, pp. 447–458.
- Y. Jing, Z. Zhao, G. Ahn, and H. Hu, “Morpheus: automatically generating heuristics to detect android emulators,” in Proceedings of the 30th Annual Computer Security Applications Conference, ACSAC 2014, New Orleans, LA, USA, December 8-12, 2014. ACM, 2014, pp. 216–225.
- T. Petsas, G. Voyatzis, E. Athanasopoulos, M. Polychronakis, and S. Ioannidis, “Rage against the virtual machine: hindering dynamic analysis of android malware,” in Proceedings of the Seventh European Workshop on System Security, EuroSec 2014, April 13, 2014, 、Amsterdam, The Netherlands. ACM, 2014, pp. 5:1–5:6.
- B. Kondracki, B. A. Azad, N. Miramirkhani, and N. Nikiforakis, “The droid is in the details: Environment-aware evasion of android sandboxes,” in 29th Annual Network and Distributed System Security Symposium, NDSS 2022, San Diego, California, USA, April 24-28, 2022. The Internet Society, 2022.
- Faghihi, M. Zulkernine, and S. H. H. Ding, “Camodroid: An android application analysis environment resilient against sandbox evasion,” J. Syst. Archit., vol. 125, p. 102452, 2022.
- J. Gajrani, J. Sarswat, M. Tripathi, V. Laxmi, M. S. Gaur, and M. Conti, “A robust dynamic analysis system preventing sandbox detection by android malware,” in Proceedings of the 8th International Conference on Security of Information and Networks, SIN 2015, Sochi, Russian Federation, September 8-10, 2015. ACM, 2015, pp. 290–295