Malware comes in many different forms and offers an attacker utility at multiple stages of the cyber kill chain, whether it’s stealing data, remote exploitation, or establishing persistence on a machine. With the advent of mobile computing, malware distribution has become an even more efficient, scalable, profit-generating mechanism. Mobile apps can collect sensitive data, generate fraudulent ad revenue, or commandeer the device’s compute power for use in a botnet.

Unlike some threats that can be sporadic and ephemeral, such as network intrusion, the prevalence of malware enables us to harvest examples over time and use them as a case study to evaluate how malicious actions evolve and how we can design automated systems to detect and classify them in spite of their dynamic, evasive properties.

To do this, we need to better understand current trends in malware and how to represent them in more effective abstractions which often requires developing scalable program analysis techniques that can be embedded in large scale analysis pipelines. Crafting suitable representations of malicious behaviour, both statically and dynamically, allows us to employ statistical techniques such as machine learning that can generalise to new, previously unseen, samples.