The malware detection rate by the new function of Android 4.2 proved to be only 15%

ByLynnwallenstein

Android 4.2 (JellyBean) released by Google on November 13, 2012 has "Application verification service"Although the unauthorized application detection function called" unauthorized application detection function "is installed, North Carolina State University of the United States investigated how much the effect of this function is.

An Evaluation of the Application Verification Service in Android 4.2
http://www.cs.ncsu.edu/faculty/jiang/appverify/

The university's research team conducted experiments using 1260 malware samples shared by many research communities, including Google, to investigate the effectiveness of this function. The experimental method is examining the detection rate using the latest model of tablet "Nexus 10" equipped with Android 4.2. Detection results are shown in the figure below, 193 out of 1260 cases were detected, the detection rate was 15.32%.


Further acquired by GoogleVirusTotalI compared it with an anti-virus engine made by a third party (Avast, AVG, TrendMicro, Symantec, BitDefender, ClamAV, F-Secure, Fortinet, Kaspersky, Kingsoft).


The result is the figure below, it seems that the detection rate of 20.41% on average by Google's malware detection function and 100% from the average of 51.02% on other anti-virus engines.


Based on this result, the research team of the university commented, "The unauthorized application detection function of Android 4.2 is still immature and there is room for improvement", and the application of this functionSHA 1The method of mainly verifying the value or package name is a mechanism that is vulnerable and can be easily avoided. However, Google acquiredVirusTotal, We conclude that this function will be improved further.