See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/297591972

Android Malware Detection & Protection: A Survey

Article in International Journal of Advanced Computer Science and Applications · February 2016
DOI: 10.14569/IJACSA.2016.070262

CITATIONS READS
104 9,620

4 authors, including:

Munam Ali Shah Abid Khan

COMSATS University Islamabad University of Derby
236 PUBLICATIONS 5,761 CITATIONS 150 PUBLICATIONS 2,993 CITATIONS

SEE PROFILE SEE PROFILE

Mansoor Ahmed
ADAPT Centre / Maynooth University
86 PUBLICATIONS 1,271 CITATIONS

SEE PROFILE

All content following this page was uploaded by Munam Ali Shah on 14 March 2016.

The user has requested enhancement of the downloaded file.

 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

Android Malware Detection & Protection: A Survey

Saba Arshad Abid Khan
Department of Computer Science Department of Computer Science
COMSATS Institute of Information Technology COMSATS Institute of Information Technology
Islamabad, Pakistan Islamabad, Pakistan

Munam Ali Shah Mansoor Ahmed

Department of Computer Science Department of Computer Science
COMSATS Institute of Information Technology COMSATS Institute of Information Technology
Islamabad, Pakistan Islamabad, Pakistan

Abstract—Android has become the most popular smartphone embed malicious content into their applications. The users‟
operating system. This rapidly increasing adoption of Android sensitive data can be easily compromised and can be
has resulted in significant increase in the number of malwares transferred to other servers. Furthermore, the existence of third
when compared with previous years. There exist lots of party application stores contribute in spreading malwares for
antimalware programs which are designed to effectively protect Android because Google Play also hosts the applications of
the users’ sensitive data in mobile systems from such attacks. In third-party developers. Android official market uses Bouncer
this paper, our contribution is twofold. Firstly, we have analyzed for protection of marketplace against malwares [5]. However,
the Android malwares and their penetration techniques used for Bouncer does not analyze the vulnerabilities of the uploaded
attacking the systems and antivirus programs that act against
apps. Malware developers take advantage of vulnerabilities
malwares to protect Android systems. We categorize many of the
most recent antimalware techniques on the basis of their
among apps by repackaging the popular apps of Google Play
detection methods. We aim to provide an easy and concise view and distributing them on other third-party app-stores. This
of the malware detection and protection mechanisms and deduce degrades the reputation of the app-store and of the reputation of
their benefits and limitations. Secondly, we have forecast the developer. Malwares includes computer viruses, Trojan
Android market trends for the year up to 2018 and provide a horses, adware, backdoors, spywares and other malicious
unique hybrid security solution and take into account both the programs which are designed to disrupt or damage the
static and dynamic analysis an android application. operating system and to steal personal, financial, or business
information. Malware developers use code obfuscation
Keywords—Android; Permissions; Signature methods, dynamic execution, stealth techniques, encryption
and repackaging to bypass the existing antimalware techniques
I. INTRODUCTION provided by Android platform.
Since 2008, the rate of smartphone adoption has increased
tremendously. Smartphones provide different connectivity
options such as Wi-Fi, GSM, GPS, CDMA and Bluetooth etc.
which make them a ubiquitous device. Google says, 1.3 million
Android devices are being activated each day [1]. Android
operating system left its competitors far behind by capturing
more than 78% of total market share in 2013 [2]. Gartner
report 2013 of smartphone sales shows that there is 42.3%
increase in sales of smartphones in comparison with 2012.
According to International data corporation IDC, Android OS
dominates with 82.8% of total market shares in 2Q 2015 [3].
Figure 1 shows the market shares of Android operating system
on yearly basis. It could be observed that Android has become
the most widely used operating system over the years.
Android platform offers sophisticated functionalities at
Fig. 1. Android Market Shares
very low cost and has become the most popular operating
system for handheld devices. Apart from the Android
In order to prevent such malwares, it is important to have
popularity, it has become the main target for attackers and
accurate and deep understanding of them so that security
malware developers. The official Android market hosts
measures to protect users‟ data could be taken accordingly.
millions of applications that are being downloaded by the users
There are large numbers of attack scenarios where an attacker
in a large number everyday [4]. Android offers an open market
can compromise a user‟s data by taking advantage of the
model where no any application is verified by any security
vulnerabilities of Android operating system. For example, a
expert and this makes Android an easy target for developers to

463 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

Trojan app downloads some HD wallpapers with user‟s

permission but this permission may allow this app to access the
user‟s contacts or other personal information and it leaks user‟s
confidential data to some other server from the device secretly.
In such a case, the wallpapers app will have Internet
permissions for download purpose. The user might not give
much attention towards other requested access permissions and
might grant READ_CONTATCS permission accidentally. As a
result, the app may modify the device settings, corrupt the
user‟s data and can transfer private data to some unknown
remote servers. This results in user‟s business data loss and
other personal information. The attackers can use the stolen
data for kidnapping, blackmailing or business loss purposes. In
an another attack scenario, attackers distribute the malicious Fig. 2. Android Malware Growth
apps as a repackaged version of some popular apps which may
offer location-based services so in that scenario malicious app II. ANDROID MALWARE ANALYSIS
kill the victim device by draining its battery with the excessive
use of GPS and radio etc. Some of the malicious programs get Wide range of malwares has been detected and the number
the user‟s device IMEI numbers and send it to remote server. of malwares are increasing every year. According to
These IMEI numbers have significant worth in black markets TrendMicro, malwares have increased to 7.10 million in first
where IMEI numbers of stolen devices can be altered with half (1H) of 2015 [8][9]. Figure 2 shows the increased number
user‟s IMEI [6]. of Android malwares over the years. The behavior of different
malware families is provided in subsequent sections.
There are hundreds of malware techniques identified which
attack the Android platforms in several ways such as sending A. Trojans
messages without the victim‟s knowledge and deleting them by Trojans appear to a user as a Benign app [5]. In fact, they
itself, sending user‟s private information to some other server actually steal the user‟s confidential information without the
and many more. So there is a great need to protect user‟s data user‟s knowledge. Such apps can easily get access to the
from these malwares. browsing history, messages, contacts and device IMEI numbers
etc. of victim‟s device and steal this information without the
This ever increasing malware threats have forced the consent of user. FakeNetflix [10] is an example of such
Android antimalware industry to develop the solutions for malwares that provide user interface identical to original
mitigating malicious app threat on Android smartphones and Netflix app and collect the user‟s login credentials. SMS
other Android devices. Two main approaches are used for this Trojans exploit the premium services to incur financial loss to
purpose: Static approach and Dynamic approach. Antivirus the victim. Fakeplayer is a well-known SMS Trojan that sends
programs use any of these approaches to protect the mobile messages to premium rate numbers without user awareness
systems from the malware attacks. They detect the malicious [11]. Zsone [12] and Android.foney are also the examples of
apps and notify the user about such apps and take measures to such SMS Trojan apps. Malwares also capture the user‟s
remove these malwares. With the increasing number of threat banking information such as account number and password.
level, the antivirus detection rate has also increased. As a result Zitmo and Spitmo Trojans are designed to steal the user‟s
of threat & malware, and protection mechanism offered by mTANs (Mobile Transaction Authentication Number) which
Android antimalware programs, the overall risk situation of then complete the transactions silently [13].
Android users is difficult to assess [7].
B. Backdoors
In this paper, we have analyzed different malwares, their
behaviors and techniques used by different malware types to Backdoors employ the root exploits to grant root privileges
attack Android devices. Furthermore, the paper provides to the malwares and facilitate them to hide from antiviruses.
detailed review on different antimalware techniques, their Exploid, Rageagainstthecage (RATC) and Zimperlich are the
advantages and limitations. On the basis of this review, a top three root exploits which gain full- control of device [14].
hybrid solution for Android security has been proposed. The DroidKungFu [15] uses root exploits, Exploid and
rest of the paper is organized as follow. Section II classifies the Rageagainstthecage, in an encrypted form. When
existing malwares on the basis of their behavior. Section III DroidKungFu executes, it first decrypts and launches the root
consists of malware penetration techniques employed by the exploits. If the root exploit succeed to gain control over device
attackers. In Section IV, a detailed analysis on the malware and root privilege, the malware become able to perform any
detection and removal methods for the protection of Android operation on the device even the installation of applications
devices has been performed. Section V consists of performance keeping the user unaware of this act [16].
evaluation of antimalware mechanisms. The future trends for C. Worms
Android market shares and malware growth and limitations for
existing antimalware approaches are provided in Section VI. A Such malwares create copies of it and distribute them over
solution has also been proposed in this section which is aimed the network. For example, Bluetooth worms spread malware
at providing better security mechanism. The paper is concluded through the Bluetooth network by sending copies of it to the
in Section VII.

464 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

paired devices. Android.Obad.OS is the example of Bluetooth of app .This process of repackaging is done by reverse-
worm [17]. engineering tools. During repackaging, malicious authors
change the signature of repackaged app and so the app seems
D. Spyware new to the antimalware. TrendMicro report have shown that
Nickspy [11] and GPSSpy [18] are the examples of spyware 77% of the top 50 free apps available in Google Play are
apps which appear as benign app, but it actually monitors the repackaged [22].
user‟s confidential information such as messages, contacts,
bank mTANs, location etc. for some undesirable consequences. B. Drive By Download
Personal spywares can install the malicious payload without It refers to an unintentional download of malware in the
the victim‟s knowledge. It sends the user‟s information such as background. Drive by download attacks occur when a user visit
text messages, contacts etc. to the attacker who installed that a website that contains malicious content and injects malware
software on victim‟s device [6]. into the victim‟s device without the user‟s knowledge.
Malware developers use Android/NotCompatible [23] which is
E. Botnets one of the drive-by download app.
Botnet is a network of compromised Android devices.
Botmaster, a remote server, controls the botnet through the C. Dynamic Payloads
C&C network. Geinimi [11] is one of the Android botnets. Malwares also penetrate into Android devices through
dynamic payload technique. They encrypt the malicious
F. Ransomwares content and embed it within APK resources. After installation,
Ransomware prevent the user from accessing their data on the app decrypts the encrypted malicious payload and executes
device by locking the device, until ransom amount is paid. the malicious code. Some malwares, instead of embedding
FakeDefender.B [19] is a malware that masquerades itself as payload as resource, download the malicious content from
avast!, an antivirus. It locks the victim‟s device and force the remote servers dynamically and are not detected by static
user to pay ransom amount to unlock the device. analysis approach [24].
G. Riskwares D. Stealth Malware Techniques
Riskwares are the legitimate software exploited by the On Android device malware scanners cannot perform deep
malicious authors to reduce the performance of device or harm analysis because of the availability of limited resources such as
the data e.g., delete, copy or modify etc. [20]. Table 1 below battery. Malware developers exploit these hardware
shows the top malware types detected in 2015 by TrendMicro vulnerabilities and obfuscate the malicious code to easily
[21]. bypass the antimalware. Different stealth techniques such as
key permutation, dynamic loading, native code execution, code
TABLE I. TOP ANDROID MALWARE TYPES IN 2015 encryption and java reflection are used to attack the victim‟s
device.

The statistical data obtained from [21] has been computed

and plotted in Figure 3 which presents the top Android
malware families recorded by TrendMicro in second quarter
(2Q) of 2015. According to the report, 24% of the total
malwares were guided variants, which do not have any GUIs
and silently run at the background without the user‟s
knowledge.
Fig. 3. Malware families seen in 2015
III. MALWARE PENETRATION TECHNIQUES
A. Repackaging IV. ANDROID MALWARE DETECTION
Malware authors repackage the popular applications of There are mainly two approaches to analyze the Android
Android official market, Google Play, and distribute them on malwares: Static and Dynamic Approach. We have further
other less monitored third party app-store. Repackaging categorized the antimalware using static and dynamic
includes the disassembling of the popular benign apps, both approaches. Figure 4 shows the taxonomy of existing
free and paid; append the malicious content and reassembling antimalware techniques based on our study.

465 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

Fig. 4. Taxonomy of Existing Android Antimalwares

positives as it may classify the clean apps as malicious on the

A. Static Approach basis of percentage.
Static approach is a way to check functionalities and
maliciousness of an application by disassembling and DroidAnalytics [27] is a signature based analytic system
analyzing its source code, without executing the application. It which extract and analyze the apps at op-code level. It not only
is useful for finding malicious behaviors that may not operate generates the signature but also associate the malware with
until the particular condition occurs. existing malwares after identifying the malicious content. It
generates 3 level signatures. First it generates signature at
1) Signature Based Approach method level by API call tracing then combining all the
Signature based malware detection methods are commonly signatures of methods in a class it generates the class level
used by commercial antimalware products. This method signatures and at third level it generates the application
extracts the semantic patterns and creates a unique signature signature by combining the signatures of the classes in the
[25]. A program is classified as a malware if its signature application. Authors have used DroidAnalytics to detect 2,494
matches with existing malware families‟ signatures. The major malware samples from 102 malware families and 342
drawback of signature based detection is that it can be easily repackaged malwares from other six malware families. The
circumvented by code obfuscation because it can only identify limitations of this method includes, it classifies the apps as
the existing malwares and fails against the unseen variants of malware on the basis of classes mostly used by malware
malwares. It needs immediate update of malware variants as families but during experiment they found some signatures that
they are detected. are used by both the legitimate apps and malwares. Also the
similarity score used for detection of repackaged malwares do
Faruki et al. [26] proposed AndroSimilar, a robust
not provide 100% solution or it may also provide false positive,
statistical signature method to detect the unknown variants of
classify the legitimate app as malware.
existing malwares that are usually generated by using
repackaging and code obfuscation techniques. It generates the  Limitation of Signature Based Detection: Although
variable length signature for the application under test and signature based detection is very efficient for known
compares it with the signatures in AndroSimilar malware malwares but it cannot detect the unknown malware
database and identify the app as malware and benign on the types. Also because of limited signature database most
basis of similarity percentage. Authors tested the AndroSimilar of the malwares remain undetected.
against 1260 apps among which 6779 apps were Google Play
apps and 545 apps were from third party app store. They also 2) Permission Based Analysis:
used code obfuscation techniques such as method renaming, In Android system, permissions requested by the app plays
string encryption, control flow obfuscation and junk method a vital role in governing the access rights. By default, apps
insertion techniques to change the signature of the code and have no permission to access the user‟ data and effect the
tested the effectiveness of AndroSimilar against 426 samples. system security. During installation, user must allow the app to
The solution detected more than 60% samples correctly. access all the resources requested by the app. Developers must
AndroSimilar compares the signatures of the applications in mention the permissions requested for the resources in the
order to distinct between the malwares and benign apps but it AndroidManifest.xml file. But all declared permissions are not
has limited signature database as compared to the other necessarily the required permissions for that specific
antivirus solutions. So any unseen malwares will remain application.
undetected. Also the similarity percentage creates the false

466 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

Ref. [28] has shown that most of the time developers have performance of permission based detection of malware and
declared the permissions that are not actually required by the showed that more than 81% of malicious apps samples can be
application which makes it difficult to detect the malicious detected by the permission based detection method. Proposed
behavior of application. Antimalware analyzes the Android method provides the quick filter for malware detection but the
Manifest.xml file where all the permissions for the resources performance values generated by the classifiers are not perfect
required by the app are mentioned. Stowaway [28] exposes the and we cannot completely rely on those results.
permission over privilege problem in Android where an app
requests more permissions than it actually uses. Stowaway Sanz Borja et al. [33] presented PUMA for detection of
performs static analysis to determine the API calls invoked by malicious apps by analyzing the requested permissions for
the application and then it maps the permissions required by application. They used permission tags such as <uses-
the API calls. They found that one third applications are over permission> and <uses-features> present in
privileged among 940 Android application samples. It cannot AndroidManifest.xml file to analyze the malicious behavior of
resolve the API calls invoked by applications with the use of apps and applied different classifier algorithms on dataset of
java reflections. 357 benign apps and 249 malicious apps. The solution provides
high detection rate but results generated have high false
In [29], authors have proposed a light weight malware positives rate also it is not adequate for efficient detection of
detection mechanism which only analyze the manifest file and malware it still requires information related to other features
extract the information such as permissions, intent filters ( and dynamic analysis.
action, category and priority), process name and number of
redefined permissions to detect the malicious behavior of an Shin et al. [34] used a state machine based approach and
application. After extracting such information, they compare it formally analyze the permission based Android security model.
with the keyword list provide in the proposed method and then They also verified that the specified system satisfy the security
calculate the malignancy score. They used Weka [30] which is property.
a data mining tool for calculation of threshold value. At last Tang, Wei et al. [35] proposed a Security Distance Model
they compare the malignancy score with threshold value and for mitigation of Android malware. Security Distance Model is
classify the app as malware if malignancy score exceeds based on the concept that not a single permission is enough for
threshold value. They have used 365 samples to test the an application to threaten the security of Android devices. For
efficiency of proposed solution and the solution provides 90% example an application requesting permission
accurate detection. It is cost saving mechanism as it only READ_PHONE_STATE can access the phone number and
includes the analysis of manifest file and can be implemented IMEI but it cannot move data out of the device. There must be
in other detection architectures easily to detect malwares a combination of permissions to affect the security model of
efficiently. Also it can detect even those malwares that remain device such as INTERNET permission allows to concept the
undetected by signature based detection method. This proposed device with the network and will be needed to move data to
solution is limited to manifest file information. Also it cannot some remote server. The SD measure the dangerous level of
detect the adware samples. application on the basis of permissions requested by the app.
C. Y. Haung et al. [31] proposed a method for better Authors classify the combinations of permissions into four
detection of permission based malware detection which groups and assigned threat points (TP) to each group such as
includes the analysis of both requested and required TP-0, 1, 5 and 25 to Safe SD, Normal SD, Dangerous SD and
permissions as most of the time malware authors declare more Severe SD. Before the installation of new application it
permissions in the manifest file than they actually require for calculates the threat point from the combination of permissions
the application. Also it analyses the easy to retrieve features requested by the application. That helps the user to get aware
and then labels the application as benign or malware. Three of more dangerous permissions while installation of app. It can
different labeling types are used for this purpose which easily detect the unknown malwares with very high threat
includes site based labeling; scanner based labeling and mixed points. They found 500 threat points for the Geinimi malware
labeling. In site based labeling it labels the app as benign if it is which is a very clear variation from benign apps. A limitation
downloaded from Google official app market and if it is of this solution includes that applications with threat points
downloaded from some malicious source then the app is between 50 and 100 are not easy to identify as benign and
labeled as malicious. In the second labeling scheme, if the malware. They could be the benign apps with such permission
antivirus scanner declares the app as benign the app is label as combinations or malwares.
benign and same for the malware case. In the mixed labeling Enck et al. [36] developed KIRIN, a tool that provides light
the app is labeled on the basis of both site based and scanner weight certification at installation time. It defines the security
based labels. After labeling all the samples are divided into rules and simply compares the requested permissions of app
three datasets and requested permissions of these datasets are with its security rules and certifies the app as malware if it fails
analyzed by the machine learning algorithms such as Naive to pass all the security rules. The installation of app is aborted
Bayes, AdaBoost, Support Vector Machine and Decision Tree if the app is attributed as malware. Authors have tested 311
[32]. On the basis of results generated by these classifiers we applications downloaded from official Android market and
can evaluate the performance of permission based detection found that 5 applications failed to pass the specified rules.
method. in [31] authors have performed experiment on data set Proposed solution is light weight as it only analyzes the
of 124,769 benign and 480 malicious apps. They analyzed the Menifest.xml file. The limitation of KIRIN includes that it may

467 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

also declare some legitimate applications as malware because requires extension in analysis of concurrency and reflection
the information provided for application certification is not handling.
adequate for detection of malware.
Zhou et al. [42] implemented DroidMOSS that extract the
DroidMat [37] is a tool that extracts the information from Dalvik Byte code sequence and developer information of
manifest file such as permissions, message passing through application by using baksmali tool [43] and generate finger
intents and API call tracing to analyze the behavior of prints for each app by using fuzzy hashing techniques to create
application. It applies K-means clustering that increases the the fixed sized 80 byte signature to detect the repackaged
malware detection capability and classify the applications as applications. On the basis of similarity score it identifies the
benign or malware by using KNN algorithm [38]. It is more repackaged apps. Authors have applied DroidMOSS to test 200
efficient than Androgaurd [39] as it takes lesser time to identify samples from six different third party market places and
the 1,738 apps as malware or benign. Also it is cost saving as it detected that 5% to 13% apps were repackaged. The proposed
doesn‟t require dynamic simulation and manual efforts. But as solution cannot detect the repackaged apps if the original app is
a static based detection method it cannot detect the malwares not present in database. Also because of limited database most
which dynamically load the malicious content such as of the malwares remains undetected. Google play store may
DroidKngFu and BaseBridge. also contain malwares. The limitation of this solution also
includes that they have assumed all the Google Play apps as
 Limitation of Permission Based Detection: Permission legitimate apps and then matched the signature of the apps
based detection is a quick filter for the application taken from other app store to detect the repacked apps.
scanning and identifying that whether the application is
benign or malware but it only analyses the manifest file DroidAPIMiner [44], build upon Androgaurd [39],
it do not analyze other files which contain the identifies the malware by tracking the sensitive API calls ,
malicious code. Also there is very small difference in dangerous parameters invoked and package level information
permissions used by the malicious and benign apps. within the bytecode. To classify the application as benign or
Permission based methods require second pass to malware it implements KNN algorithm [38] and detected up to
provide efficient malware detection. 99 % accuracy and 2.2% false positive rate.
3) Dalvik Bytecode Analysis: Fuchs et al. [45] presented SCandroid which analyze the
In Android, Dalvik is a register-based VM. Android apps Android application statically as they are installed and
are developed in java language, compiled in java bytecode and performs data flow analysis to checks whether the data flow
then translated to dalvik byte code. Bytecode analysis helps us through the applications is consistent or not. On the basis of
to analyze the app behavior. Control and data flow analysis data flows it declares the application as safe to be run with
detect the dangerous functionalities performed by malicious requested permissions. Authors use it as a security certification
apps. tool for Android apps.
Jinyung Kim et al. [40] developed SCANDAL, a static Many researchers worked on conversion of Dalvik
analyzer that analyze the dalvik byte code of applications and bytecode to Java bytecode and then performed static analysis
detects the privacy leakage in applications. It determines the on java code to detect the malicious behavior of the app. ded
data flow from information source to any remote server. Dalvik [46] and Dare [47] are the tools used for conversion of dalvik
bytecode contains branch, method invocation and jump bytecode into java bytecode. These tools are also useful when
instructions which alters the order of execution of code and developers don‟t distribute the java source code, in such case
obfuscates the code. During execution, the possible paths that one must analyze the source code to detect the malware
an application can take can be identified by the Bytecode through static analysis. Dexpler tool [48] converts the Dalvik
analysis. In [40] Authors have examined 90 applications from bytecode into Jimple code which is used by static analysis
Android official market and 8 malicious applications from framework named Soot [49]. It makes the Soot to read the
third party market place. They found privacy leakage in 11 Dalvik Bytecode directly and perform the static analysis
Google market applications and 8 third party market without converting Dalvik bytecode into java bytecode. Well
applications. There is a need of performance optimization known static analysis framework used by researchers is WALA
techniques to implement as SCANDAL consumes more time which perform static analysis on java bytecode to detect
and memory for analysis of application. Also it does not privacy leakage within malicious apps [50].
support the applications which use reflections for data leakage. Chin et al. [51] presented a tool named ComDroid that
In the SCANDAL authors have implemented reflection detect the communication based vulnerabilities among Android
semantics manually to detect the privacy leakage in malicious apps. They have analyzed 20 samples and detected 34
apps taken from black market. exploitable vulnerabilities among 12 applications. It uses
Karlsen et al. [41] presented the first formalization of Dedexer tool [52] to disassemble the dex files in the app. It
Dalvik Bytecode along with java reflective features. They performs the static analysis on Dalvik files, analyzes the
examined 1700 popular Android Apps to determine what permissions listed in the manifest.xml file of the app, performs
Dalvik Bytecode instructions and features are mostly used by intraprocedural analysis and examines the Intents of the apps to
the Android Apps. Such formalization helps to perform control detect the communication vulnerabilities
and data flow analysis in order to detect the malicious apps or  Limitations of Dalvik Bytecode Detection: In this
to identify the sensitive API calls invoked during execution. It method analysis is performed at instruction level and
supports the dynamic dispatch and reflective features. But it

468 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

consumes more power and storage space. As the in third party developer apps. It labels the sensitive data and
android devices are resource poor so they limits this keeps track of that data and app when tainted data leaves
detection approach. moves from the device. It provides efficient tracking of
sensitive information but it do not perform control flow
B. Dynamic Approach tracking. Also it cannot track information that leaves deice and
Dynamic analysis examines the application during returns in network reply.
execution. It may miss some of the code sections that are not
executed but it can easily identify the malicious behaviors that 3) Emulation Based Detection
are not detected by static analysis methods. Although static Yan et al. [60] present Android dynamic analysis platform
analysis methods are faster to malware detection but they fail DroidScope, based on Virtual Machine Introspection. As the
against the code obfuscation and encryption malwares. antimalware detect the presence of malwares because both of
them reside in the same execution environment so the
In [53] , Egele provided a detailed overview of different malwares also can detect the presence of antimalware.
dynamic analysis methods used for discrimination between DroidScope monitors the whole operating system by staying
malware and benign apps. Dynamic analysis approach is out of the execution environment and thus have more
effective against polymorphic and metamorphic code privileges than the malware programs. It also monitors the
obfuscation techniques employed by the malwares [54] but it Dalvik semantics thus the privilege escalation attacks on kernel
requires more resources. can also be detected. It is built upon QEMU. DroidDream and
1) Anomaly Based Detection DroidKungFu [61] were detected with this technique.
Iker et al. [55] proposed CrowDroid to detect the behavior Blaising et al. [62] proposed Android Application Sandbox
of applications dynamically. Details of system calls invoked by (AASandbox) which detect the suspicious applications by
the app are collected by the Strace tool [56] and then performing both static and dynamic analysis on them. It first
crowdsourcing app, which is installed on the device, creates a extracts the .dex file into human readable form and then
log file and sends it to remote server. Log file may include the performs static analysis on application. Then it analyzes the
following information: Device information, apps installed on low level interactions with system by execution of application
device and system calls. 2-mean clustering algorithm is applied in isolated sandbox environment. Actions of application are
at server side to classify the application as malware or benign. limited to sandbox due to security policy and do not affect the
Results are stored at server database. The solution provides data on device. It uses Money tool to dynamically analyze the
deep analysis and thus require large amount of resources. The application behavior which randomly generates the user events
solution requires client app to be installed on the user‟ device like touches, clicks and gestures etc. it cannot detect the new
and may classify the legitimate app as malware if it invoke malware types.
more system calls.
V. PERFORMANCE EVALUATION & ANALYSIS
Shabtai et al. [57] proposed Andromly , a behavior based
Android malware detection system. In order to classify the In this section, we evaluate the performance of different
application as benign or malware it continuously monitor the parameters and provide a comprehensive comparison of
different features and patterns that indicate the device state different attributes. Table 2 provides the limitations of the
such as battery level, CPU consumption etc. while it is running static and dynamic approach of the malware detection. The
and then apply the machine learning algorithms to discriminate malware detection through static analysis and dynamic analysis
between malicious and Benign apps. the solution can detect is provided in Table 3 and Table 4 respectively.
continuous attacks and can notify the user about these attacks.
TABLE II. LIMITATIONS OF STATIC AND DYNAMIC APPROACHES
AntiMalDroid [58], a malware detection framework using
SVM algorithm is proposed by Zhao, can identify the Mechanism Limitations
malicious apps and their variants during execution. First it
monitors the behavior of applications and their characteristics Signature based
then it categorize these characteristics as normal and malicious Cannot detect unknown malware types.
detection
behavior. Then it puts the two types of characteristics into
May consider benign app as malicious because of
learning module and generates the signatures for the behavior Permission
very small difference between permissions
characteristics, produced by learning module. Then it store the based detection
requested by both types.
signature in database and compare it with the already existing
Static

malware and benign app signatures. It classify the app as Dalvik bytecode
More power and memory consumption.
benign if the signature matches with already existing benign detection
app‟ signatures. The solution can extend the signature database Incorrect if a benign app shows same behaviors
Anomaly
dynamically and can provide high detection rate. But it detection
e.g., invoke more API calls or consumes more
consumes more time while detection process. battery and memory.

2) Taint Analysis Not suitable for real time analysis

Taint Analysis
Dynamic

Reduce performance. 20 times slowdown system

Enck et al. [59] proposed TaintDroid which provides
system-wide information flow tracking for Android. It can Emulation
More resource consumption.
simultaneously track multiple sources of sensitive data such as based detection
camera, GPS and microphone etc. and identify the data leakage

469 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

On the basis of their working techniques we have deduced major limitations and benefits for each detection mechanism.
TABLE III. MALWARE DETECTION THROUGH STATIC ANALYSIS

Approach Name Goal Method Year Limitations Benefits

 Creates variable length signature and  Limited signature database

Detect unseen
compares with signature database.  Similarity percentage may
AndroSimil
and zero day
 Use fuzzy hashing technique classify benign apps as  Effective against code
samples of 2013 obfuscation and
ar [26]
known  Differentiates between benign and malicious.
malicious apps on the basis of similarity  Can only detect known repackaging.
malwares.
percentage. malware variants

Signature  Similarity score may  Effective against

Based Automatic mutations and
 Create 3 level signatures for app on the classify legitimate apps as
Detection collection, repackaged apps.
basis of API calls. malicious.
extraction,
 Perform Op-code level analysis (method,  Some level 2 signatures  Associates malware at
DroidAnaly analysis and op-code level
class, application). 2013 classified as malwares are
tics [27] association of
 Correlate application with existing also used by legitimate  Easy malware and
Android dynamic payload
malwares in database via similarity score apps.
malwares. tracking.
based on class level signature.  Cannot detect unknown
malware types.  Also detect dynamic
malware payloads.

 API call tracing through static analysis

tool.
Permission Application
Stowaway  Permission map to identify the  Cannot resolve complex  Notify about the over
Based over privilege 2011
[28] permissions required by each API cal. reflective calls privileged applications.
Detection detection

 Light weight approach

 Low cost
 Analyze manifest file  Can detect the unknown
 Compare extracted information with malwares.
 Cannot detect adware
Malware keyword list.
samples  Can detect the malwares
detection by  Calculate malignancy score that remain undetectable
R.Sato [29] 2013  Generates results only on
manifest file  Compare malignancy score with threshold by signature based
the basis of manifest file.
analysis. values detection.
 Classify the app as malware if malignancy  Can be implemented in
score exceeds threshold values. other security systems
for better malware
detection.

 Analyze the required and requested  Performance numbers

permissions for application generated by classifiers are
 Analyze easy to retrieve features not perfect.
Performance
 Labels apps as benign or malware using  Cannot completely rely on  Can use different
evaluation on
site based, scanner based and mixed results generated by classifiers for different
C.Y.Haung permission
labeling 2013 classifiers. scenarios.
[31] based
 Use machine learning algorithms on three  Ada Boost identifies all  Quick filter for malware
malware
detection. data sets (on the basis of labels) apps as legitimate. detection.
 Evaluate the permission based malware  Naïve Bayes also do not
detection performance. give précised results.

 Analyze extracted permissions

 Use the <use permissions> and <use
features> tags.  High false positive rate
PUMA [32]
Malware
 Classify apps by using machine learning 2013  Not adequate for efficient  High detection rate
detection
algorithms. malware detection
 Evaluate the performance by k-fold cross
validation with k=10.

Application
assessment  Applications with threat  Provide malware
 Uses Security Distance Model to measure identification during
Tang Wei and analysis to point between 50 and 100
dangerous level due to combination of 2011 installations.
[34] extend are difficult to identify as
android
requested permissions.
malware or benign apps.  Can detect unknown
security malwares

470 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

Risk
 Uses security rules  May declare benign app as  Light weight certification
assessment of application at
 Compares the security configuration of malware because mostly
and installation time.
Kirin [35] application with security rules 2009 similar permissions are
certification of
 Certifies the app as malware if app fails to requested by benign and  Low cost.
applications at
satisfy all the security rules. malicious apps.  Block the malicious
install time. applications.

 More time and memory

consumption
 Needs performance
 Extracts bytecode of application as a  Saves the data from
improvement techniques to
dalvik executable file privacy leakage.
implement.
SCANDAL Privacy leak  Translates dalvik executable into dalvik  Dalvik bytecode is
2012  Does not support
[38] detection core, an intermediate language for always available.
applications that use
efficient analysis
reflections for privacy  Does not need reverse
leakage engineering tools
 Does not support java
native interface libraries

Dalvik  Supports reflection and

bytecode  Provides formal control flow analysis.  Requires extension in dynamic dispatch
Karlsen features.
formalization  Formalizes dalvik bytecode language with 2013 analysis of reflection and
[39]
and control reflection features. concurrency handling.  Formal control flow
flow analysis analysis easily traces the
API calls.

 Extract instructions in app and developer

 It assumes all the Google
Dalvik information.
Play apps as legitimate
Bytecode  Uses baksmali tool for dalvik bytecode
Repackaged apps.
Detection DroidMOS
malicious app
extraction.
2012  Limited database.  Effective detection of
S [40]  Generates fingerprint for each app by repackaged apps.
detection  Cannot detect repackaged
applying fuzzy hashing techniques
apps if original app is not
 Measures similarity between apps to
present in database.
detect repackaged apps

 More occurrences of false

API level
DroidAPIM  Extract API level features positives
iner [42]
Malware
 Apply classifiers for evaluation
2013
 May generate incorrect  Better accuracy.
detection
classification.

Application
data flow  Analyze data flows in app.
SCanDroid  Cannot be applied to  Provide security at install
analysis and  Make decision to classify app as benign or 2009
[43] packaged applications. time.
security malware on the basis of data flow.
certification

 Extract dalvik executable files

Application  Does not verify the
 Disassemble DEX files using dedexer
ComDroid communicatio
tool. 2011
existence of malware  Issue warnings about
[49] n vulnerability  Require users to manually threats.
detection  Keep logs of the communication
investigate the warnings
vulnerabilities

471 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

TABLE IV. MALWARE DETECTION THROUGH DYNAMIC ANALYSIS

Approach Name Goal Method Year Limitations Benefits

 CrowDroid client app installed on user‟

device.  Requires the
installation of
Detect  Strace tool perform system calls tracing.
CrowDroid client
 Creates a log file and send to remote server.
anomalously application to perform  Provides deep
CrowDroid [53] behaving  Dynamic analysis is performed on the data at 2011 detection. analysis.
server side.
malicious  Results incorrect if
applications  Consider that malicious apps invoke more legitimate app invokes
system calls. more system calls.

 Continuously monitor the features and events

e.g., battery level, data packets transferred  Only four artificially  Can detect the
through Internet, CPU consumption and created malware continuous attacks.
Andromly [55]
Malware running processes. 2012 instances were used for  Alerts the user
detection  Apply machine learning classifiers to testing the system about detected
discriminate between benign and malicious  Battery drainage issue. anomaly.
applications.
 Monitor the behavior of applications and
their characteristics  Can detect
 Categorize the characteristics into normal unknown
behavior and malicious behavior malwares and their
Malware  Put these characteristic types into learning variants in
detection module runtime.
 Generate behavioral characteristics.  Extends malware
through  More time
 Generate the signatures for these behavioral database
Anomaly Detection

AntiMalDroid [56] characteristic 2011 consumption.

learning and characteristics dynamically.
signature  Store these signatures to database.  Higher detection
generation.  Compares a signature with the signatures in rate
the database.  Low cost and
 Declares as a malware if signature matches better
with malware signature in database. performance.

 Only track data flows

 Automatically labels the data.
Taint Analysis

and do not track

Data flow  Keeps track of the data. control flows.  Efficient tracking
TaintDroid [57]
analysis and  Records the label of the data, source and 2010  Cannot track of sensitive
leakage destination device if the data moves out of information that leaves information
detection the device. the device and return in
network reply.
 System calls tracking
 Built upon QEMU (quick emulator)  Can detect
privilege
Android  Monitors the OS and Dalvik semantics
 Limited code coverage escalation attacks
DroidScope [58] malware  Perform virtual machine introspection based 2012
analysis on the kernel.
dynamic analysis
Emulation Based Detection

 Extracts a class.dex file and decompiles it

into human readable form. Can be used to
 Performs static analysis on application. improve the
AASandbox [60]
Malware  Executes the application in sandbox and 2010
Cannot detect new efficiency of the
detection perform dynamic analysis malwares antimalware
 Uses Monkey tool to analyze the malicious programs for
behavior of app. Android OS

472 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

120

Growth Percentage 100

80

60

40

20

0
2012 2013 2014 2015 2016 2017 2018
Current 6.93 79.8 84.8 82.8
Increase 89.8 94.8 99.8 99.99
Decrease 82.8 80.8 78.8 76.8
Average 86.3 87.8 89.3 88.4

Fig. 5. Expected future trends of android OS market share

then perform dynamic analysis. This hybrid solution may be an

VI. DISCUSSION expensive method to apply because of the limited available
The popularity of Android operating system is increasing resources such as battery, memory etc. However, the limitation
tremendously. The yearly records, presented by IDC [3], show of this hybrid solution can be addressed in twofold. Firstly, the
that Android OS market shares in second quarter (2Q) of 2015 static analysis can be performed locally on the Android device;
are 82.8%, which is 2% decrease from the 2Q 2014. If the and afterwards, the dynamic analysis could be performed in a
value remains the same till the end of year and keep on distributed fashion by sending the malicious activity or event in
decreasing every year with the same rate then we can expect the form of a log file to a remote server. The remote server can
that in 2018, the Android market shares will drop to 76.8%. perform the dynamic analysis quickly and efficiently as the
According to same record, the Android shares have increased server will have enough resources to perform dynamic analysis
5% in 2014 from previous year. If it keep on increasing with and can generate rapid responses against the application
the same rate and increases up to 89.8% till the end of 2016 behavior and the user can be instantly notified. However, this
then we can say that the Android shares will grow up to 99.9% hybrid solution needs more investigation and is subject to the
in 2018. Furthermore, it is predicted that the market shares of design tradeoffs. The future works will focus to develop such
the Android will be on average 88.4% in 2018. The estimations hybrid antimalware to provide better security for android
and future predictions of the Android market are computed and devices.
plotted in Figure 5. It should be noted that with the increased
usage of the Android based devices, the number of malwares VII. CONCLUSION
attacking Android is increasing at an exponential rate. In 2015, In this paper, the malwares and their penetrations
number of Android malwares spiked to 7.10 million. This
figure is 2.84 million more than the previous year [8][9]. If the
malware growth keeps on increasing with the same ratio, it is
expected that this number will be increased up to 15.8 million
in 2018. The malware growth trends are predicted and
estimated values are provided in Figure 6.
In contrast to malwares, the antimalware have been
designed and developed in a wide range in order to protect the
devices. It is inferred that an antimalware using static approach
is less efficient in detecting the malicious contents that are
loaded dynamically from remote servers. Although, the
dynamic approach is efficient as it keeps on monitoring the
application and able to detect the malicious content at
execution time. However, the portions of malicious code that
are not executed remain undetected. It is believed that any
single security solution in Android cannot provide full Figure 6: Future Trends of Android Malware Growth
protection against the vulnerabilities and malwares. It is better techniques have been thoroughly analyzed. The antimalware
to deploy more than one solution simultaneously for example, are categorized on the basis of detection methods they use. A
a hybrid of two approaches, i.e. static and dynamic. The hybrid detailed performance evaluation of these antimalware
approach will first statically analyze the application and will

473 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

techniques is also provided and the benefits and limitations of 5–8, 2012.
these antimalware are deduced comprehensively. At the end, a [17] “contagio mobile: Backdoor.AndroidOS.Obad.a.” [Online]. Available:
concept of hybrid antimalware is presented which will address http://contagiominidump.blogspot.in/2013/06/backdoorandroidosobada.
html. [Accessed: 28-Oct-2015].
the limitations of existing static and dynamic approaches. In
[18] C. a Castillo, “Android Malware Past , Present , and Future,” McAfee
future, it is aimed to implement the proposed hybrid solution White Pap. Mob. Secur. Work. Gr., pp. 1–28, 2011
which will be a generic antimalware that will provide better
[19] “Android.Fakedefender.B | Symantec.” [Online]. Available:
security for Android devices by firstly statically analyzing the https://www.symantec.com/security_response/writeup.jsp?docid=2013-
Android applications on local device and then it will perform 091013-3953-99. [Accessed: 15-Dec-2015].
dynamic analysis on a remote antimalware server. This will [20] “Riskware | Internet Security Threats.” [Online]. Available:
consume very small amount of memory space on the device http://usa.kaspersky.com/internet-security-center/threats/riskware#.Vm-
and the battery consumption will also be low as all dynamic 5IUp97IU. [Accessed: 15-Dec-2015].
analysis will be performed at the remote server. [21] “Trend Micro Q2 Security Roundup Report | Androidheadlines.com.”
[Online]. Available: http://www.androidheadlines.com/2015/08/trend-
REFERENCES micro-q2-security-roundup-report.html. [Accessed: 08-Dec-2015].
[1] “Eric Schmidt: „There Are Now 1.3 Million Android Device Activations [22] “A Look at Repackaged Apps and their Effect on the Mobile Threat
Per Day.‟” [Online]. Available: http://techcrunch.com/2012/09/05/eric- Landscape.” [Online]. Available: http://blog.trendmicro.com/trendlabs-
schmidt-there-are-now-1-3-million-android-device-activations-per-day/. security-intelligence/a-look-into-repackaged-apps-and-its-role-in-the-
[Accessed: 28-Oct-2015]. mobile-threat-landscape/. [Accessed: 15-Dec-2015].
[2] “Gartner Says Annual Smartphone Sales Surpassed Sales of Feature [23] “NotCompatible Android Trojan: What You Need to Know | PCWorld.”
Phones for the First Time in 2013.” [Online]. Available: [Online]. Available:
http://www.gartner.com/newsroom/id/2665715. [Accessed: 28-Oct- http://www.pcworld.com/article/254918/notcompatible_android_trojan_
2015]. what_you_need_to_know.html. [Accessed: 15-Dec-2015].
[3] “IDC: Smartphone OS Market Share 2015, 2014, 2013, and 2012.” [24] New Threats and Countermeasures in Digital Crime and Cyber
[Online]. Available: http://www.idc.com/prodserv/smartphone-os- Terrorism. IGI Global, 2015.
market-share.jsp. [Accessed: 08-Dec-2015]. [25] A. Aiken, “Apposcopy : Semantics-Based Detection of Android
[4] “Number of available Android applications - AppBrain.” [Online]. Malware Through Static Analysis,” Fse 2014, pp. 576–587, 2014.
Available: http://www.appbrain.com/stats/number-of-android-apps. [26] P. Faruki, V. Ganmoor, V. Laxmi, M. S. Gaur, and A. Bharmal,
[Accessed: 28-Oct-2015].
“AndroSimilar: Robust Statistical Feature Signature for Android
[5] “Android and Security - Official Google Mobile Blog.” [Online]. Malware Detection,” Proc. 6th Int. Conf. Secur. Inf. Networks, pp. 152–
Available: http://googlemobile.blogspot.in/2012/02/android-and- 159, 2013.
security.html. [Accessed: 28-Oct-2015].
[27] M. Zheng, M. Sun, and J. C. S. Lui, “DroidAnalytics : A Signature
[6] A. P. Felt, M. Finifter, E. Chin, S. Hanna, and D. Wagner, “A survey of Based Analytic System to Collect , Extract , Analyze and Associate
mobile malware in the wild,” Proc. 1st ACM Work. Secur. Priv. Android Malware,” 2013.
smartphones Mob. devices - SPSM ‟11, pp. 3 – 14, 2011.
[28] Android Permissions Demystified.” [Online]. Available:
[7] R. Fedler, J. Schütte, and M. Kulicke, “On the Effectiveness of Malware https://www.truststc.org/pubs/848.html. [Accessed: 06-Nov-2015].
Protection on Android,” p. 36, 2013.
[29] R. Sato, D. Chiba, and S. Goto, “Detecting Android Malware by
[8] “Mind the (Security) Gaps: The 1H 2015 Mobile Threat Landscape - Analyzing Manifest Files,” pp. 23–31, 2013.
Security News - Trend Micro USA.” [Online]. Available: [30] “Weka 3 - Data Mining with Open Source Machine Learning Software
http://www.trendmicro.com/vinfo/us/security/news/mobile-safety/mind- in Java.” [Online]. Available: http://www.cs.waikato.ac.nz/ml/weka/.
the-security-gaps-1h-2015-mobile-threat-landscape. [Accessed: 08-Dec- [Accessed: 16-Dec-2015].
2015].
[31] C.-Y. Huang, Y.-T. Tsai, and C.-H. Hsu, “Performance evaluation on
[9] “The Mobile Landscape Roundup: 1H 2014 - Security News - Trend permission-based detection for android malware,” Adv. Intell. Syst.
Micro USA.” [Online]. Available: Appl. - Vol. 2, vol. 21, pp. 111–120, 2013.
http://www.trendmicro.com/vinfo/us/security/news/mobile-safety/the-
mobile-landscape-roundup-1h-2014. [Accessed: 08-Dec-2015]. [32] S. Ben-david, Understanding Machine Learning : From Theory to
Algorithms. 2014.
[10] R. Raveendranath, V. Rajamani, A. J. Babu, and S. K. Datta, “Android
malware attacks and countermeasures: Current and future directions,” [33] B. Sanz, I. Santos, C. Laorden, X. Ugarte-Pedrero, P. G. Bringas, and G.
2014 Int. Conf. Control. Instrumentation, Commun. Comput. Technol., Álvarez, “PUMA: Permission usage to detect malware in android,” Adv.
pp. 137–143, 2014. Intell. Syst. Comput., vol. 189 AISC, pp. 289–298, 2013.
[11] Y. Zhou and X. Jiang, “Dissecting Android Malware: Characterization [34] W. Shin, S. Kiyomoto, K. Fukushima, and T. Tanaka, “Towards formal
and Evolution,” 2012 IEEE Symp. Secur. Priv., no. 4, pp. 95–109, 2012. analysis of the permission-based security model for Android,” 5th Int.
Conf. Wirel. Mob. Commun. ICWMC 2009, pp. 87–92, 2009.
[12] “Security Alert: Zsone Trojan found in Android Market | Lookout
Blog.” [Online]. Available: [35] W. Tang, G. Jin, J. He, and X. Jiang, “Extending android security
https://blog.lookout.com/blog/2011/05/11/security-alert-zsone-trojan- enforcement with a security distance model,” 2011 Int. Conf. Internet
found-in-android-market/. [Accessed: 15-Dec-2015]. Technol. Appl. iTAP 2011 - Proc., 2011.
[13] L. Davi, A. Dmitrienko, C. Liebchen, and A.-R. Sadeghi, “Over-the-Air [36] W. Enck, M. Ongtang, and P. McDaniel, “On lightweight mobile phone
Cross-platform Infection for Breaking mTAN-based Online Banking application certification,” Proc. 16th ACM Conf. Comput. Commun.
Authentication,” Black Hat Abu Dhabi, pp. 1–12, 2012. Secur. - CCS ‟09, pp. 235–245, 2009.
[14] “root exploits.” [Online]. Available: [37] D.-J. Wu, C.-H. Mao, T.-E. Wei, H.-M. Lee, and K.-P. Wu, “DroidMat:
http://www.selinuxproject.org/~jmorris/lss2011_slides/caseforseandroid. Android Malware Detection through Manifest and API Calls Tracing,”
pdf. [Accessed: 15-Dec-2015]. 2012 Seventh Asia Jt. Conf. Inf. Secur., pp. 62–69, 2012.
[15] “Trojan: Android/DroidKungFu.C Description | F-Secure Labs.” [38] L. Kozma, “k Nearest Neighbors algorithm ( kNN ),” 2008.
[Online]. Available: https://www.f-secure.com/v- [39] “androguard - Reverse engineering, Malware and goodware analysis of
descs/trojan_android_droidkungfu_c.shtml. [Accessed: 15-Dec-2015]. Android applications ... and more (ninja !) - Google Project Hosting.”
[16] Y. Zhou, Z. Wang, W. Zhou, and X. Jiang, “Hey, You, Get Off of My [Online]. Available: https://code.google.com/p/androguard/. [Accessed:
Market: Detecting Malicious Apps in Official and Alternative Android 01-Dec-2015].
Markets,” Proc. 19th Annu. Netw. Distrib. Syst. Secur. Symp., no. 2, pp. [40] J. Kim, Y. Yoon, and K. Yi, “S CAN D AL : Static Analyzer for

474 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 7, No. 2, 2016

Detecting Privacy Leaks in Android Applications.” 2011.

[41] E. R. Wognsen, H. S. Karlsen, M. C. Olesen, and R. R. Hansen, [52] “Dedexer user‟s manual.” [Online]. Available:
“Formalisation and analysis of Dalvik bytecode,” Sci. Comput. http://dedexer.sourceforge.net/. [Accessed: 08-Nov-2015].
Program., vol. 92, no. December 2012, pp. 25–55, 2014. [53] M. Egele, T. Scholte, E. Kirda, and C. Kruegel, “A survey on automated
[42] W. Zhou, Y. Zhou, X. Jiang, and P. Ning, “Detecting repackaged dynamic malware-analysis techniques and tools,” ACM Comput. Surv.,
smartphone applications in third-party android marketplaces,” Proc. vol. 44, no. 2, pp. 1–42, 2012.
Second ACM Conf. Data Appl. Secur. Priv. - CODASKY ‟12, pp. 317– [54] I. You and K. Yim, “Malware obfuscation techniques: A brief survey,”
326, 2012. Proc. - 2010 Int. Conf. Broadband, Wirel. Comput. Commun. Appl.
[43] “[Utility][Tool][Windows] Baksmali / Smali Ma… | Android BWCCA 2010, pp. 297–300, 2010.
Development and Hacking.” [Online]. Available: http://forum.xda- [55] I. Burguera, U. Zurutuza, and S. Nadjm-Tehrani, “Crowdroid: Behavior-
developers.com/showthread.php?t=2311766. [Accessed: 22-Dec-2015]. Based Malware Detection System for Android,” Proc. 1st ACM Work.
[44] Y. Aafer, W. Du, and H. Yin, “DroidAPIMiner: Mining API-Level Secur. Priv. smartphones Mob. devices - SPSM ‟11, p. 15, 2011.
Features for Robust Malware Detection in Android,” Secur. Priv. [56] “strace download | SourceForge.net.” [Online]. Available:
Commun. Networks, vol. 127, pp. 86–103, 2013. http://sourceforge.net/projects/strace/. [Accessed: 22-Dec-2015].
[45] A. P. Fuchs, A. Chaudhuri, and J. S. Foster, “SCanDroid : Automated [57] A. Shabtai, U. Kanonov, Y. Elovici, C. Glezer, and Y. Weiss,
Security Certification of Android Applications.” “„Andromaly‟: a behavioral malware detection framework for android
[46] W. Enck, D. Octeau, and P. Mcdaniel, “A Study of Android Application devices,” J. Intell. Inf. Syst., vol. 38, no. 1, pp. 161–190, 2012.
Security,” no. August, 2011. [58] M. Zhao, F. Ge, T. Zhang, and Z. Yuan, “AntiMalDroid: An efficient
[47] D. Octeau, S. Jha, and P. McDaniel, “Retargeting Android applications SVM-based malware detection framework for android,” Commun.
to Java bytecode,” in Proceedings of the ACM SIGSOFT 20th Comput. Inf. Sci., vol. 243 CCIS, pp. 158–166, 2011.
International Symposium on the Foundations of Software Engineering - [59] W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and
FSE ‟12, 2012, p. 1. A. N. Sheth, “TaintDroid: An Information-Flow Tracking System for
[48] A. Bartel, J. Klein, M. Monperrus, and Y. Le Traon, “Dexpler: Realtime Privacy Monitoring on Smartphones,” Osdi ‟10, vol. 49, pp. 1–
Converting Android Dalvik Bytecode to Jimple for Static Analysis with 6, 2010.
Soot,” 2012. [60] L. Yan and H. Yin, “Droidscope: seamlessly reconstructing the os and
[49] “A framework for analyzing and transforming Java and Android dalvik semantic views for dynamic android malware analysis,” Proc.
Applications.” [Online]. Available: http://sable.github.io/soot/. 21st USENIX Secur. Symp., p. 29, 2012.
[Accessed: 07-Nov-2015]. [61] F. Wu, H. Narang, and D. Clarke, “An Overview of Mobile Malware
[50] “Main Page - WalaWiki.” [Online]. Available: and Solutions,” J. Comput. Commun., vol. 2, no. 2, pp. 8–17, 2014.
http://wala.sourceforge.net/wiki/index.php/Main_Page. [Accessed: 07- [62] T. Bläsing, L. Batyuk, A. D. Schmidt, S. A. Camtepe, and S. Albayrak,
Nov-2015]. “An android application sandbox system for suspicious software
[51] E. Chin, A. Felt, K. Greenwood, and D. Wagner, “Analyzing inter- detection,” Proc. 5th IEEE Int. Conf. Malicious Unwanted Software,
application communication in Android,” Proc. 9th …, pp. 239–252, Malware 2010, pp. 55–62, 2010.

475 | P a g e
www.ijacsa.thesai.org
View publication stats