Malware Detection in Android Apps Using Static Analysis Thesis

Static Analysis means an analysis that has been simplified in which the effect of any instantaneous change to a system is calculated without considering the longer-term response of that system to the change. On the other ...

Static Analysis means an analysis that has been simplified in which the effect of any instantaneous change to a system is calculated without considering the longer-term response of that system to the change. On the other hand, dynamic analysis is done to consider how the particular system is expected to respond to the change over time (Wikipedia, n.d.). Static analysis performs the exploration of a system or a software without actually executing it. This is achieved through the analysis of the source code or the binaries of the system. This process helps in understanding the code structure, and also helps to ensure that the code adheres to industry standards. For classifying behaviour of Android apps, different static features such as permissions, Interprocess communication (IPC), developer ID, API calls, intents, hardware, code semantics and components have been used to detect malware (Idrees et al., 2017). However, features like permissions, API calls, and IPC have gained more attention from the researchers. Android apps run as a separate virtual machine on the device, so by default it does not have any authority to perform operations such as accessing resources such as SMS, contacts, gallery etc. or altering the settings of Wi-Fi, Bluetooth etc. It requires the consent or the approval of the user to perform any action on the device. This is achieved via the concept of permissions. Apps can explicitly request these privileges through permissions (Idrees et al., 2017). As discussed in the prior sections, it is quite evident that misuse of these permissions can cost the users massively. The objective of study in this paper is to perform a static analysis on android apps by examining the permissions requested and the key category factor and finally detecting whether an app is benign or malware without running it. This section gives an overview of the static analysis performed and the results which will be passed in the interface for testing the malicious behaviour of an unknown android app.