Android Malware Detection

Abstract

For the past few decades, the growth in usage of mobile phones has been increasing abnormally. Recent surveys hypothesize most of the mobile phone market segment is benignly dominated by Android Operating System and this made the Android OS (Operating System) the most vulnerable Operating System; as more users are adopting to use Android OS (Operating System) most often, malware attacks on Android operating systems have been increasing, this can be considered as one of the significant issues and a security threat for every mobile phone users. For the past decade or so, we have been seeing many malware detection software which has adopted a technique called Signature-Based malware detection, which is used to detect malware in Android applications, as the name describes that software extracts a string called the signatures or package name from the input app or APK (Android application package) and tries to predict the presence of malware. However, this approach is limited to identifying only a few known malware. In short, the malware detection software will extract the signature from the Android application and compare it with a set of publicly available databases where package names of known malware apps are available, which contains a list of package names of popular malware applications. The most efficient way of identifying unknown malware is to extract more information regarding the apk. So the point is how we can extract the data within the scope of user permission? So, any tool or a script can find this information in the Android manifest file of the target APK (Android application package). Usually, every android app has this file to let OS know what kind of permissions are requested, and it also stores metadata of the application. So, from the Android Manifest File, the signatures and the approvals defined in that file are then being extracted and compared with the dataset through an artificial neural network; this model will be trained from a huge malware dataset and the input apk, by this way the neural network is capable of identifying the malware by analyzing the extracted permissions and strings.