AppBeach: A Static Behavior Checker for iOS Mobile Applications

Abstract

AppBeach standing on App Behavior Checker is a new service to reconstruct and report behaviors of iOS mobile applications, using static binary analysis to reveal embedded functions within the executables. AppBeach adopts a distributed algorithm on call sequence counting via the hadoop framework, achieving a scalable static syntax analysis on executables of modern apps. The main idea is syntactically counting call sequences that are embedded in iOS executable. This is done by distributing routines to mappers with the assembly tool that resolves explicit and implicit system method calls that are embedded in the iOS executables. The reducer then collects the counting from mappers to characterize the behaviors of apps. We learn patterns of malicious behaviors from the difference of pairs of normal and malicious apps, and report the probability of potential behaviors of commercial apps by matching these patterns to their call sequence counts.