DroidCollector: A Honeyclient for Collecting and Classifying Android Applications

In software testing process, test data generation represents an important step for high quality software, even for mobile devices. As proposed in previous works, a potential source for random data generation is represented by the UI layout files that are used for almost all mobile platforms (Android, iOS, Windows Phone/Mobile). This paper continues the previous work and presents a test data generation system based on Android layout files. The test data generator uses DSL files as input and generates test data that conform to several testing principles. The generated test data could be stored in XML files or any format required by the testing frameworks.

The popularity of the Android operating system has been rising ever since its initial release in 2008. This is due to two major reasons. The first is that Android is open-source, due to which a lot of mobile manufacturing companies use some form of modified Android OS for their devices. The second reason is that a wide variety of applications with different designs and utility can be built with ease for Android devices. With this much popularity, gaining unwanted attention of cybercriminals is inevitable. Hence, there has been a huge rise in the number of malware being developed for Android devices. To address this problem, we present ADAM (Automatic Detection of Android Malware), an Android application that uses machine learning (ML) for automatic detection of malware in Android applications. ADAM is trained with CICMalDroid 2020 Android Malware dataset and tested for both CICMalDroid 2020 and CICMalDroid 2017 dataset. The experiment analysis showed that it achieves more than 98.5% accuracy. ADAM considers only static analysis, so becomes easy to deploy in smart phone to alert the user. ADAM is deployed over android mobile phone.KeywordsSecurityMalware detectionAndroidMachine learning

Mobile devices are frequent targets of malware due to the large volume of sensitive personal, financial, and corporate data they process. Traditional static, dynamic, and hybrid analysis methods are increasingly insufficient against evolving threats. This paper proposes a resilient deep learning framework for Android malware detection, integrating multiple models and a CPU-aware selection algorithm to balance accuracy and efficiency on mobile devices. Two benchmark datasets (i.e., the Android Malware Dataset for Machine Learning and CIC-InvesAndMal2019) were used to evaluate five deep learning models: DNN, CNN, RNN, LSTM, and CNN-LSTM. The results show that CNN-LSTM achieves the highest detection accuracy of 97.4% on CIC-InvesAndMal2019, while CNN delivers strong accuracy of 98.07%, with the lowest CPU usage (5.2%) on the Android Dataset, making it the most practical for on-device deployment. The framework is implemented as an Android application using TensorFlow Lite, providing near-real-time malware detection with an inference time of under 150 ms and memory usage below 50 MB. These findings confirm the effectiveness of deep learning for mobile malware detection and demonstrate the feasibility of deploying resilient detection systems on resource-constrained devices.

Over the past few years, Android Application is deemed as one of the fastest-growing technology areas. On the other hand, the rapid growth of android applications also increases the security threats for Android users in the form of malware. Malware hacks the personal information of a user and exploits it in different criminal activities. To date, various studies have been conducted for the detection of android malware. Some authors have preferred static analysis while others have performed dynamic analysis for android malware detection. In static analysis, researchers have only employed one feature of android application either intents or permissions. As best of our knowledge, there does not exist any technique that combines both intents and permissions. In this paper, we have performed static analysis for the detection of Android malware using android intents (both implicit and explicit), android permissions and combination of intents and permissions. Furthermore, the classification is performed to analyze the effectiveness of different machine learning algorithms for malware detection and to identify the best performing feature. Our experiment results show that combination of intents and permissions play a key role in the detection of android malware.

Android based Smartphones are nowadays getting more popular. While using Smartphone, user is always concerned about security and malicious attacks, cryptographic vulnerability of the applications. With increase in the number of Android mobiles, Android malwares are also increasing very rapidly. So the authors have proposed the “Identification of cryptographic vulnerability and malware detection in Android” system. They have designed a user friendly android application, through which user and developer can easily test the application whether it is benign or vulnerable. The application will be tested firstly using static analysis and then the dynamic analysis will be carried out. The authors have implemented static and dynamic analysis of android application for vulnerable and malicious app detection. They have also created a web page. User can either use the application or the web page.

Cyber attacks are prevailing to be a great headache for the technical advancements especially when dealt with mobile usage in an android application environment. For a new user, it is difficult to identify the set of harmful permissions. This could be an advantage for malware intruders to access the data or infect the mobile device by introducing malware applications. Thus the face of Cybersecurity has changed in recent times with the advent of new technologies such as the Cloud, the internet of things, mobile/wireless, and wearable technology. The technological advances in data science which help develop contemporary cybersecurity solutions are storage, computing, and behavior. In this paper, the possible investigations are done on the cyber attacks in android by adopting the various malware classification and detection techniques. Various Classifications and Detections are done on various malware prevailing in the android applications.

The rapid growing of the Android application and malware has increased the usage of the application category in Android malware detection and application searching. However, the defects of management of Android Market lead to a great deal of applications miscategorization. Therefore, it's helpful for both organizing the Android Market and Android malware detection to give an approach that can automatically distinguish different categories of the applications. In this paper, we present an effective approach for automatically categorizing Android applications based on Bayesian classification. Considering the category of the application is determined by its function, we extracted the used permissions and strings that can reflect the application function from the application itself and Android Market as classification features. Finally, we conduct experiments with 13005 applications that are composed of 18 categories with Naive Bayes. The evaluation results show that our approach can achieve better accuracy and performance than previous coarse-grained feature extraction methods.

Android is the most widely used mobile operating system (OS). A large number of third-party Android application (app) markets have emerged. The absence of third-party market regulation has prompted research institutions to propose different malware detection techniques. However, due to improvements of malware itself and Android system, it is difficult to design a detection method that can efficiently and effectively detect malicious apps for a long time. Meanwhile, adopting more features will increase the complexity of the model and the computational cost of the system. Permissions play a vital role in the security of the Android apps. Term Frequency—Inverse Document Frequency (TF-IDF) is used to assess the importance of a word for a file set in a corpus. The static analysis method does not need to run the app. It can efficiently and accurately extract the permissions from an app. Based on this cognition and perspective, in this paper, a new static detection method based on TF-IDF and Machine Learning is proposed. The system permissions are extracted in Android application package’s (Apk’s) manifest file. TF-IDF algorithm is used to calculate the permission value (PV) of each permission and the sensitivity value of apk (SVOA) of each app. The SVOA and the number of the used permissions are learned and tested by machine learning. 6070 benign apps and 9419 malware are used to evaluate the proposed approach. The experiment results show that only use dangerous permissions or the number of used permissions can’t accurately distinguish whether an app is malicious or benign. For malware detection, the proposed approach achieve up to 99.5% accuracy and the learning and training time only needs 0.05s. For malware families detection, the accuracy is 99.6%. The results indicate that the method for unknown/new sample’s detection accuracy is 92.71%. Compared against other state-of-the-art approaches, the proposed approach is more effective by detecting malware and malware families.

Android applications often contain vulnerabilities that can be exploited by malicious software, making automated malware detection is crucial. Since software vulnerabilities can have severe repercussions, a great deal of research and development effort has been put into developing mitigation strategies. Over the past few years, a number of different approaches have been tried in an effort to lessen the danger posed by vulnerabilities in software. The proposed approach involves multiple stages, including APK recompilation, feature extraction from manifest permissions, model training, testing, and performance analysis. The process begins with APK recompilation, where Android package files are decompiled using specialized tools to extract critical components such as manifest.xml, which contains permissions requested by the application. These permissions serve as key indicators of potential malicious intent. The extracted XML-based permissions and additional metadata are then transformed into structured feature vectors. Feature selection techniques are applied to retain the most relevant attributes, reducing noise and enhancing classification accuracy. The core classification module leverages Recurrent Neural Networks (RNNs) to analyze the extracted features and identify malicious patterns. The model undergoes supervised training using a labeled dataset comprising both benign and malicious APKs. During training, the RNN learns temporal dependencies and feature interactions, improving its ability to detect sophisticated malware. Once trained, the model is tested on a separate dataset to evaluate its classification performance. Various evaluation metrics such as accuracy, precision, recall, and F1-score are used to measure effectiveness. Finally the proposed model is compared with traditional machine learning classifiers and existing deep learning techniques. The results demonstrate that RNN-based classification significantly enhances malware detection accuracy due to its ability to process sequential patterns within application permissions. This research contributes to the field of Android security by presenting an efficient, scalable, and automated malware detection framework, leveraging deep learning for real-time classification of malicious applications.

GHGDroid: Global heterogeneous graph-based android malware detection

The rapid growth of Android applications has led to increased security threats, making malware detection a critical concern in cybersecurity. This research proposes a static analysis-based technique that employs machine learning for Android malware detection. The proposed method utilizes three classification algorithms: Support Vector Machine (SVM), Random Forest, and Decision Tree. The tool extracts static permission features from APK files to evaluate their effectiveness. The dataset consists of 400 Android applications (200 benign and 200 malicious), which were analyzed using the three machine learning models. Their performance was evaluated and compared using accuracy , precision, recall, and F1-score. The Random Forest model achieved the highest accuracy. The results demonstrate that static analysis combined with a robust classification model can effectively identify malicious applications with a high degree of accuracy. Although the tool is reliable in detecting Android malware, it has limitations in handling obfuscated and dynamic threats. Future research could focus on integrating dynamic analysis techniques to improve detection accuracy and enhance resistance to evasion techniques

Nowadays, Android system is the most popular mobile smart operating system on the market. However, the number of Android malware has increased sharply and Android malware spreads quickly and has lots of variants. The existing traditional Android malware detection systems are mostly based on the explicit relationship between Android applications, and their detection accuracy and detection efficiency need to be improved. In this paper, we establish an heterogeneous information network to represent the structural and semantic relations between Android application entities. Then we combine relation matrices and meta-paths to get entity features, and we propose two aggregation operations to learn Android application features. Finally, we use the Multi-Layer Perception neural network to detect Android malware. Through testing on the real data sets, the results show that our system takes into account both accuracy and efficiency.

Deep learning feature exploration for Android malware detection

In this paper, we have done detection of android malware using static and dynamic analysis. This approach also knows as hybrid approach. Our goal is to find recent vulnerabilities in social engineering applications which cannot be detected by modern antivirus or online scanners. The hackers inject malicious code into benign application modify the nature of code and hence forth strength attack can be polymorphic or stealth techniques. We are building model using supervised learning applying SVM (Supervised Learning Machine) taking features as input and label for decision whether malicious or benign application also added hyper parameter tuned for obtaining better accuracy rate. By using this classifier, we can make binary classification and henceforth suggest a decision support system for end user to protect themselves from recent threats that can come to their android application.

Atlas is a new software analysis platform from EnSoft Corp. Atlas decouples the domain-specific analysis goal from its underlying mechanism by splitting analysis into two distinct phases. In the first phase, polynomial-time static analyzers index the software AST, building a rich graph database. In the second phase, users can explore the graph directly or run custom analysis scripts written using a convenient API. These features make Atlas ideal for both interaction and automation. In this paper, we describe the motivation, design, and use of Atlas. We present validation case studies, including the verification of safe synchronization of the Linux kernel, and the detection of malware in Android applications. Our ICSE 2014 demo explores the comprehension and malware detection use cases. Video: http://youtu.be/cZOWlJ-IO0k