APK Sential : Hybrid Static and Multi-Engine Cloud-Based Android Malware Detection System

Abstract: Due to unprecedented growth, Android platform has become a lucrative target for malware distribution. Malware has been distributed in APK files where users are tricked into downloading those. Signature based and single engine malware scanners fail in detecting new and polymorphic malware, hence making millions of Android users vulnerable. APK Sentinel is a hybrid malware detection tool on the Android platform where a three layer analysis is employed. APK file system static properties are analyzed. [2] DEX byte code disassembly using Androguard is used to collect API calls. [6] Hash lookup via VirusTotal API is also used to collect information from 70+ antivirus engines. [4] Each data point is used in weighted scoring risk analysis to generate a risk score out of 100. APK Sential tool proved that by combining three techniques together in one system provides much better performance than any individual method in the system with 96% detection rate.

Keywords: APK Analysis, Static Analysis, DEX Bytecode, Permission Analysis, Mobile Security, Hybrid Detection.