Abstract
Android malware is widespread despite the effort provided by Google in order to prevent it from the official application market, Play Store. Two techniques namely static and dynamic analysis are commonly used to detect malicious applications in Android ecosystem. Both of these techniques have their own advantages and disadvantages. In this paper, we propose a novel hybrid Android malware analysis approach namely mad4a which uses the advantages of both static and dynamic analysis techniques. The aim of this study is revealing some unknown characteristics of Android malware through the used various analysis techniques. As the result of static and dynamic analysis on the widely used Android application datasets, digital investigators are informed about some underestimated characteristics of Android malware.
Introduction
Smartphones have changed the life of people dramatically in the last decade thanks to the provided functionalities and mobility. Android leads the mobile operating system market by being used on over 2 billion monthly active devices (Burke, 2017; Popper, 2017). According to a recent report by IDC1 , Android dominates the global smartphone market with being used on 85% of smartphones in all around the world (IDC Smartphone OS Market Share, 2017). It is expected that Android's global market share is expected to rise to 90% in 2017 (Bosnjak, 2017). As a result of this popularity, the official application market, Play Store, is used to install 82 billion applications in 2016 (Burke, 2017). It is reported that Play Store is growing at three times the rate of Apple's App Store which is the official application market of iOS and the biggest official mobile application market after Play Store (Lookout, 2011). As a result of this popularity, Play Store attracts the attention of malware developers (Delac et al., 2011; Portokalidis et al., 2010; Wu et al., 2012; Zhou et al., 2012). Android malware has grown by 580% between September 2011 and September 2012 (Protalinski, 2012). According to a recent report by Check Point2 , the Android malware app “Judy” may have reached as many as 36.5 million users (The Judy Malware Possibly the largest malware campaign found on Google Play, 2017).
Conclusion
Smartphones are key targets of malware developers since they contain sensitive information about users such as contact lists which contain personal phone numbers, the details of user's bank accounts, the location of the user, the notes of the user, the calendar of the user, and the private chats of the user. According to the reports, Android is currently the most popular mobile operating system in the world. Android applications are distributed through the official application market namely Play Store. Despite that Google utilizes some security tools to detect the malicious applications which are available in Play Store, it is reported that the store still contains some malicious applications. Hence, a more comprehensive approach is necessary to detect more malicious application while not including the false negative samples. Therefore, in this paper, we propose a hybrid Android malware analysis approach namely mad4a. mad4a utilizes both static and dynamic analysis techniques in order to provide more comprehensive analysis and cover more malware detection approaches as many as possible. The widely used datasets which are publicly available are used to evaluate the proposed approach.
