Detection of Malware on Android based on Application Features

Abstract — Threat of mobile malware is increasing day by day. Since Android is the most popular and maximum sold mobile phone, there is an increasing threat of malware on Android based mobile device. The different antimalware products available in market can detect the malware in its original form. But they cannot detect the malware after applying some form of obfuscation or transformation to the malware. The malware detection method based on permission feature of application can lead to many undetected malwares. This paper proposes to do more comprehensive static analysis of application covering more features, in addition to permission features. This increases the malware detection strength. The different features which would be analyzed are permissions and suspicious API calls. Doing this would detect the malware with more accuracy. The application would be classified as benign or malware correctly. First the permissions are extracted from the manifest file and the API calls are extracted from disassembled code. Weights are assigned to permissions and API calls based on their malicious nature. If the total weight of permissions and API calls of an application exceed a predefined threshold, then the application is categorized as malware