With the widespread application of machine learning-based Android malware detection methods, building a high-quality dataset has become increasingly important. Existing large-scale datasets are mostly annotated with VirusTotal by aggregating the decisions of antivirus engines, and most of them indiscriminately accept the decisions of all engines. In reality, however, these engines have different capabilities in detecting malware, especially those that have been obfuscated. Previous research has revealed that code obfuscation degrades the detection performance of these engines to varying degrees. This makes us believe that using all engines indiscriminately is unreasonable for dataset annotation. Therefore, in this paper, we first conduct a data-driven evaluation to confirm the negative effects of code obfuscation on engine-based dataset annotation. To gain a deeper understanding of the reasons behind this phenomenon, we evaluate the availability, effectiveness and robustness of every engine under various code obfuscation techniques. Then we categorize the engines and select a set of obfuscation-robust engines. Finally, we conduct comprehensive experiments to verify the effectiveness of the selected engines for dataset annotation. Our experiments show that when 50% obfuscated samples are mixed into the training set, on the classic malware detectors Drebin and Malscan, using our selected engines can effectively improve detection performance by 15.21% and 19.23%, respectively, compared to using all the engines.

Android has designed Parcel as its high-performance serialization mechanism to pass objects across processes. For classes to be serialized by Parcel, developers must implement the methods for writing and reading the object's properties to and from a Parcel container. The inconsistency between those methods implemented by careless developers introduces Parcel Mismatch bugs, often occurring in vendor-customed classes due to lack of public scrutiny. Parcel Mismatch bugs can be abused by malicious applications to gain system privilege. However, no mature solutions exist to detect Parcel Mismatch bugs. This paper proposes PMDET, a fuzzing-based detection tool for Parcel Mismatch bugs. PMDET is capable of handling different vendors' firmware without actual devices. It loads Parcelable classes from Android firmware, emulates the Android runtime environment for Parcel to work, and monitors the serialization and deserialization procedures for mismatches. We evaluate PMDET with various Android firmware from different vendors. PMDET has identified 12 previously undisclosed mismatches, 6 of which are exploitable. Source code: https://github.com/tkmikan/pmdet.