Android Application Package Research Articles

Benchmarking Android Malware Analysis Tools

Today, malware is arguably one of the biggest challenges organisations face from a cybersecurity standpoint, regardless of the types of devices used in the organisation. One of the most malware-attacked mobile operating systems today is Android. In response to this threat, this paper presents research on the functionalities and performance of different malicious Android application package analysis tools, including one that uses machine learning techniques. In addition, it investigates how these tools streamline the detection, classification, and analysis of malicious Android Application Packages (APKs) for Android operating system devices. As a result of the research included in this article, it can be highlighted that the AndroPytool, a tool that uses machine learning (ML) techniques, obtained the best results with an accuracy of 0.986, so it can be affirmed that the tools that use artificial intelligence techniques used in this study are more efficient in terms of detection capacity. On the other hand, of the online tools analysed, Virustotal and Pithus obtained the best results. Based on the above, new approaches can be suggested in the specification, design, and development of new tools that help to analyse, from a cybersecurity point of view, the code of applications developed for this environment.

Android Malware Classification Based on Fuzzy Hashing Visualization

The proliferation of Android-based devices has brought about an unprecedented surge in mobile application usage, making the Android ecosystem a prime target for cybercriminals. In this paper, a new method for Android malware classification is proposed. The method implements a convolutional neural network for malware classification using images. The research presents a novel approach to transforming the Android Application Package (APK) into a grayscale image. The image creation utilizes natural language processing techniques for text cleaning, extraction, and fuzzy hashing to represent the decompiled code from the APK in a set of hashes after preprocessing, where the image is composed of n fuzzy hashes that represent an APK. The method was tested on an Android malware dataset with 15,493 samples of five malware types. The proposed method showed an increase in accuracy compared to others in the literature, achieving up to 98.24% in the classification task.

App Development in Virtual Reality

Our project aims to create an immersive application in the realm of virtual reality (VR) entitled as [APP DEVELOPMENT IN VIRTUAL REALITY]. The main goal is to provide users with an engaging and interactive experience by utilizing VR technologies and design principles. By carefully developing the application using a chosen VR development platform/engine, we aspire to create a seamless and captivating virtual environment that responds to user interactions and offers a unique combination of entertainment and utility. In summary, our project seeks to push the boundaries of VR application development, promising an exciting and innovative contribution to the VR landscape that will enhance user experiences in this dynamic digital realm. The primary goal of this project is to create a virtual reality application that immerses users in a simulated environment, where they can have interactive experiences. By utilizing advanced VR technology, the objective is to design an app that provides users with captivating and realistic experiences. Through the use of motion controllers and head tracking, the app will enable users to interact naturally and intuitively, thus enhancing their sense of presence in the virtual world. Moreover, the app will incorporate a variety of sensory inputs, including visual, auditory, and haptic feedback, in order to create an experience that truly engages the user's senses. Keywords: virtual reality, frames per second, android application package

RESEARCH ON DEEP LEARNING TECHNOLOGY TO DETECT MALICIOUS FOR HEALTHCARE SYSTEM

With the popularity of smart phones, Android has a large number of users. Android allows download and installation of other unofficial healthcare system applications, so it has attracted the attention of malware developers for healthcare system. However, most of the papers proposed a variety of different methods to improve accuracy, and the samples tested by each method in the experimental part are different, which may cause errors in comparison. It shows that permission is an important of the development as mobile phone storage. Therefore, this paper proposed Android’s Permission and application program interface (API) as two features to perform machine learning to detect malicious programs business intelligence. It also uses machine learning method and other two algorithms to detect malicious programs. The average accuracy of using hybrid detection of unknown malicious programs reaches 89%, and the hit rate near 90%. The results show that under the same sample situation, the accuracy rate of the hybrid method used Random Forest is higher than the other two analyses. Compared with the dynamic analysis with others, it used the hybrid method and dynamic analysis has a high accuracy rate. The contribution of this paper is as follows: the advantage of static detection is that it does not need to execute Android application package (APK) features be extracted, and the speed is the fastest among the three detection modules. The features of dynamic detection for healthcare system are generated through the executed APK, and more powerful features can be extracted. Hybrid detection uses two method features, and extract most advantageous features to generate detection modules to detect APKs. The accuracy of static results about 87% in average, 88% for dynamic, and 89% for hybrid.

Using multi-audio feature fusion for android malware detection

Detecting mobile Android malware is still a challenge, despite the numerous research efforts. This paper presents a static detection approach that employs music information retrieval techniques. Detection based on a single, or a few, acoustic features suffer from reduction in classification accuracy, due to the use of limited ‘views’. In this paper, we propose a multi-audio feature-fusion approach, which merges audio features of heterogeneous views in order to detect Android malware. Sixty-three standard audio signal processing features and thirty-nine biologically inspired audio features were extracted, after converting the Android application package files into waveform audio files. The biologically inspired features were derived from Mel-Frequency Cepstral Coefficients (MFCC), Gammatone Frequency Cepstral Coefficients (GFCC), and Bark Frequency Cepstral Coefficients (BFCC). Experimental results show that the proposed audio-based malware detection features are effective and need to be further studied. Using the traditional eXtreme Gradient Boosting machine learning algorithm on the CICMaldroid 2020 dataset, the proposed approach achieved accuracy, recall, f1-score, and AUC scores of 98.96%, 99.65%, 99.30% and 98.14% respectively. An average-precision (AP) score of 100% was also achieved.

Janaka: Aplikasi Android Pembelajaran Menulis Teks Anekdot Kurikulum SMK Pusat Keunggulan

This research was carried out with the aim of producing "Janaka," an android application on anecdotal writing material in the vocational school. The method used in this research is ADDIE which consists of five stages analysis, design, development, implementation, and evaluation. This research produces an android application for learning to write anecdotes. The resulting media product has an apk format (android application package) which is a program package that can be run on smartphones with the android operating system that has gone through a series of validations with 87.5% scores from material experts and 74.4% scores from media experts and a trial with the use response value of 81.43% of students and 77.3% of teachers. The material for writing anecdotal texts is divided into three parts: simple research as anecdotal writing materials, writing anecdotes based on facts and data, and turning anecdotes into comic strips. Meanwhile, the media product component as an exercise in writing anecdotal text is divided into an interactive quiz component, an image component, a text and video component for learning materials, and a task collection platform component.

A Lightweight Multi-Source Fast Android Malware Detection Model

Most of the current malware detection methods running on Android are based on signature and cloud technologies leading to poor protection against new types of malware. Deep learning techniques take Android malware detection to a new level. Still, most deep learning-based Android malware detection methods are too inefficient or even unworkable on Android devices due to their high resource consumption. Therefore, this paper proposes MSFDroid, a lightweight multi-source fast Android malware detection model, which uses information from the internal files of the Android application package in several dimensions to build base models for ensemble learning. Meanwhile, this paper proposes an adaptive soft voting method by dynamically adjusting the weights of each base model to overcome the noise generated by traditional soft voting and thus improves the performance. It also proposes adaptive shrinkage convolutional unit that can dynamically adjust the convolutional kernel’s weight and the activation function’s threshold to improve the expressiveness of the CNN. The proposed method is tested on public datasets and on several real devices. The experimental results show that it achieves a better trade-off between performance and efficiency by significantly improving the detection speed while achieving a comparable performance compared to other deep learning methods.

Wash-free operation of smartphone-integrated optical immunosensor using retroreflective microparticles

Herein, we introduce a smartphone-integrated immunosensor based on non-spectroscopic optical detection. Sedimentation of the retroreflector and gentle inversion of the microfluidic chip was chosen as biosensing principles to ensure minimal human involvement. To realize this, wash-free immunosensing was implemented on a polymeric microfluidic chip device fabricated for light signal penetration in retroreflection signal acquisition. Applying a transparent chip and passive modulation of retroreflectors enabled the minimization of human error during sensing. In addition, a retroreflection-detectable optical gadget was constructed for integration with the commercial smartphone. The gadget had an optical chamber that induced retroreflection by integration with a smartphone. When the micro-sized reflector, named the retroreflective Janus microparticle, reacted on the sensing surface, the incident light was retroreflected towards the image sensor and quantified by a smartphone-installed Android application package. The developed application package features include time-lapse image capture performed by manipulating LED flash and camera modules, and quantification of retroreflected signal counts by image processing of time-lapse images. With this platform, the user could independently commence optical signal processing without a complicated optical setup and running software on a PC, and sensitive and reproducible immunosensing results could be obtained. The applicability test for creatine kinase-myocardial band detection from the buffer to serum was conducted and presented a calibration curve of 0–1000 ng/mL within 1 h. With the developed system, we believe that the applicability of the platform in bioanalytical detection can be expanded.

Learning-Based Detection for Malicious Android Application Using Code Vectorization

The malicious APK (Android Application Package) makers use some techniques such as code obfuscation and code encryption to avoid existing detection methods, which poses new challenges for accurate virus detection and makes it more and more difficult to detect the malicious code. A report indicates that a new malicious app for Android is created every 10 seconds. To combat this serious malware activity, a scalable malware detection approach is needed, which can effectively and efficiently identify the malware apps. Common static detection methods often rely on Hash matching and analysis of viruses, which cannot quickly detect new malicious Android applications and their variants. In this paper, a malicious Android application detection method is proposed, which is implemented by the deep network fusion model. The hybrid model only needs to use the sample training model to achieve high accuracy in the identification of the malicious applications, which is more suitable for the detection of the new malicious Android applications than the existing methods. This method extracts the static features in the core code of the Android application by decompiling APK files, then performs code vectorization processing, and uses the deep learning network for classification and discrimination. Our experiments with a data set containing 10,170 apps show that the decisions from the hybrid model can increase the malware detection rate significantly on a real device, which verifies the superiority of this method in the detection of malicious codes.

FB2Droid: A Novel Malware Family-Based Bagging Algorithm for Android Malware Detection

As the number of Android malware applications continues to grow at a high rate, detecting malware to protect the system security and user privacy is becoming increasingly urgent. Each malware application belongs to a specific family, and there is a gap in the number of malware families. The accuracy of detection can be improved if malware family information is well utilized and certain strategies are adopted to balance the variability among samples. In addition, the performance of a base classifier is limited. If an ensemble classifier or an ensemble method can be adopted, the detection effect can be further improved. Therefore, this paper proposes a novel malware family-based bagging algorithm for Android malware detection, called FB2Droid, to perform malware detection. First, five features are extracted from the Android application package. Then, the relief feature selection algorithm is used for feature selection. Next, we designed two different sampling strategies based on different families of malware to alleviate the sample imbalance in the dataset. Combined with the two sampling strategies, the traditional bagging algorithm is improved to integrate the classifier. In the experiment, several classifiers were used to evaluate the proposed scheme. The experimental results show that the proposed sampling strategy and the improved bagging algorithm can effectively improve the detection accuracy of these classifiers.

Fun Learning History: Explore the History of Water Sites Based on Android

Technological progress is a challenge for learning history in the present era. The development of student learning patterns is in accordance with the times. The latest learning models are designed according to needs. In learning history the use of local historical sources is of concern and importance. Apart from this, the study of local history is a source of character values. The attractive packaging of the local history learning design is the focus of this research. Namely by packaging local history in a fun learning design in an Android application package. Local historical sites that are utilized are Dampul spring which is located in Besta Village, Tulungrejo Village, Bumiaji District, Batu City. The use of Dampul springs varies from melasti for Hindus to consumption by residents of Besta & Village and Tulungrejo Villages. Social and cultural values and history are the potential of this water site so that it can be used as a source of learning. The method in this research includes qualitative and qualitative methods with direct field reviews, simulations and filling out questionnaires. In this activity, observations and interviews were carried out with managers and the supporting community. Historical methods are also used to reveal the historical narrative of this site. Furthermore, the syntax of learning game learning based on android is compiled by utilizing this site. Field data from this learning simulation generally includes 4 criteria, namely application view, content of the material, fun learning and learning objectives achieved, showing 77% achievement. This achievement shows that the learning design is effective

Structural similarity based common library detection method for Android

The correct classifying and filtering of common libraries in Android applications can effectively improve the accuracy of repackaged application detection. However, the existing common library detection methods barely meet the requirement of large-scale app markets due to the low detection speed caused by their classification rules. Aiming at this problem, a structural similarity based common library detection method for Android is presented. The sub-packages with weak association to main package are extracted as common library candidates from the decompiled APK (Android application package) by using PDG (program dependency graph) method. With package structures and API calls being used as features, the classifying of those candidates is accomplished through coarse and fine-grained filtering. The experimental results by using real-world applications as dataset show that the detection speed of the present method is higher while the accuracy and false positive rate are both ensured. The method is proved to be efficient and precise.

AFWDroid: Android Kötücül Yazılım Tespitinde Derin Özellik Çıkarımı ve Ağırlıklandırma

Android malware detection is a critical and important problem that must be solved for a widely used operating system. Conventional machine learning techniques first extract some features from applications, then create classifiers to distinguish between malicious and benign applications. Most of the studies available today ignore the weighting of the obtained features. To overcome this problem, this study proposes a new software detection method based on weighting the data in feature vectors to be used in classification. To this end, firstly, the manifest file was read from the Android application package. Different features such as activities, services, permissions were extracted from the file, and for classification, a selection was made among these features. The parameters obtained as a result of selection were optimized by the deep neural network model. Studies revealed that through feature selection and weighting, better performance values could be achieved and more competitive results could be obtained in weight-sensitive classification.

An efficient combined deep neural network based malware detection framework in 5G environment

While Android smartphones are widely used in 5G networks, third-party application platforms are facing a rapid increase in the screening of applications for market launch. However, on the one hand, due to the receipt of excessive applications for listing, the review requires a lot of time and computing resources. On the other hand, due to the multi-selectivity of Android application features, it is difficult to determine the best feature combination as a criterion for distinguishing benign and malicious software. To address these challenges, this paper proposes an efficient malware detection framework based on deep neural network called DLAMD that can face large-scale samples. An efficient detection framework is designed, which combines the pre-detection phase of rapid detection and the deep detection phase of deep detection. The Android application package (APK) is analyzed in detail, and the permissions and opcodes feature that can distinguish benign from malicious are quickly extracted from the APK. Besides, to obtain the feature subset that can distinguish the attributes most, the random forest with good effect is selected for importance selection and the convolutional neural network (CNN) which automatically extracted the hidden pattern inside features is selected for feature selection. In the experiment, real data from shared malware collection and third-party application download platforms are used to verify the high efficiency of the proposed method. The results show that the comprehensive classification index F1-score of DLAMD can reach 95.69%.

Detection, Traceability, and Propagation of Mobile Malware Threats

In recent years, the application of smartphones, Android operating systems and mobile applications have become more prevalent worldwide. To study the traceability, propagation, and detection of the threats, we perform research on all aspects of the end-to-end environment. With machine learning based on the mobile malware detection algorithms that integrate the dynamic and static research of the identification algorithm, application software samples are collected to study sentences. Through knowledge labeling and knowledge construction, the association relationship of knowledge is extracted to realize the research of knowledge map construction. Flooding is closely correlated with the complexity of the Android mobile version of the kernel and malicious programs. A static dynamic analysis of the mobile malicious program is carried out, and the social network social diagram is constructed to model the propagation of the mobile malicious program. We extended the approach of deriving common malware behavior through graph clustering. On this basis, Android behavior analysis is performed through our virtual machine execution engine. We extend the family characteristics to the concept of DNA race genes. By studying SMS/MMS, Bluetooth, 5G base station networks, metropolitan area networks, social networks, homogeneous communities, telecommunication networks, and application market ecosystem propagation scenarios, we discovered the law of propagation. In addition, we studied the construction of the mobile Internet big data knowledge graph. Quantitative data for the main family chronology of mobile malware are obtained. We conducted detailed research and comprehensive analysis of Android application package (APK) details and behavior, relationship, resource-centric, and syntactic aspects. Furthermore, we summarized the architecture of mobile malware security analysis. We also discuss encryption of malware traffic discrimination. These precise modeling and quantified research results constitute the architecture of mobile malware analysis.

JOWMDroid: Android malware detection based on feature weighting with joint optimization of weight-mapping and classifier parameters

Android malware detection is an important problem that must be urgently studied and solved. Machine learning-based methods first extract features from applications and then build a classifier using machine learning algorithms to distinguish malicious and benign applications. In most of the existing work, the difference in feature importance has been ignored, or the calculation of feature weights is irrelevant to the classification model. To address these issues, this paper proposes a novel Android malware detection scheme based on feature weighting with the joint optimization of weight-mapping and classifier parameters, called JOWMDroid. First, features of eight categories are extracted from the Android application package and then a certain number of the most important features are selected using information gain for malware detection. Next, an initial weight is calculated for each selected feature via three machine learning models and then five weight-mapping functions are designed to map the initial weights to the final weights. Finally, the parameters of the weight-mapping function and classifier are jointly optimized by the differential evolution algorithm. The experimental results reveal that the proposed method outperforms four state-of-the-art feature weighting methods and makes the weight-aware classifiers more competitive.

A detection method for android application security based on TF-IDF and machine learning.

Android is the most widely used mobile operating system (OS). A large number of third-party Android application (app) markets have emerged. The absence of third-party market regulation has prompted research institutions to propose different malware detection techniques. However, due to improvements of malware itself and Android system, it is difficult to design a detection method that can efficiently and effectively detect malicious apps for a long time. Meanwhile, adopting more features will increase the complexity of the model and the computational cost of the system. Permissions play a vital role in the security of the Android apps. Term Frequency—Inverse Document Frequency (TF-IDF) is used to assess the importance of a word for a file set in a corpus. The static analysis method does not need to run the app. It can efficiently and accurately extract the permissions from an app. Based on this cognition and perspective, in this paper, a new static detection method based on TF-IDF and Machine Learning is proposed. The system permissions are extracted in Android application package’s (Apk’s) manifest file. TF-IDF algorithm is used to calculate the permission value (PV) of each permission and the sensitivity value of apk (SVOA) of each app. The SVOA and the number of the used permissions are learned and tested by machine learning. 6070 benign apps and 9419 malware are used to evaluate the proposed approach. The experiment results show that only use dangerous permissions or the number of used permissions can’t accurately distinguish whether an app is malicious or benign. For malware detection, the proposed approach achieve up to 99.5% accuracy and the learning and training time only needs 0.05s. For malware families detection, the accuracy is 99.6%. The results indicate that the method for unknown/new sample’s detection accuracy is 92.71%. Compared against other state-of-the-art approaches, the proposed approach is more effective by detecting malware and malware families.

Detection of clone scammers in Android markets using IoT‐based edge computing

AbstractPirated application developers find an alternate way to publish pirated versions of the same Android mobile applications (apps) on different Android markets. Therefore, a centralized, automated scrutiny system among multiple app stores is inevitable to prevent publishing pirated or cloned version of these Android applications. In this paper, we proposed an Android clone detection system for Internet of things (IoT) (Droid‐IoT) devices. First, the proposed system receives an original Android application package (APK) file along with possible candidate cloned APKs over the cloud network. The system uses an apkExtractor tool to extract Dalvik Executable (DEX) files for each subject program. The Jdex decompiler is used to extract Java source files from DEXs. Then, the bag‐of‐word model is used to extract tokenized features from source files. Further, the weighting filters are used to zoom the importance of each token. Moreover, Synthetic Minority Oversampling is applied to retrieve balanced features for better training of data. Finally, TensorFlow with Keras deep learning model is designed to predict clones in Android applications. The experimental results have shown that Droid‐IoT can successfully detect cloned apps with an accuracy of up to 96%. The primary purpose of this system is to prevent the publishing of pirated apps among different app stores under different pirated names.

Research on Android Application Package Stealth Download Hijacking

Nowadays during the distributing and downloading of Android application packages, it is always be vulnerable to download hijacking attacks. Traffic analysis could be used by sites to detect if they are under this kind of regular download hijacking attacks. Unlike the regular ones, the stealth download hijacking attacks cannot be discovered by using such a method. By studying in an actual case, this paper presents a vulnerability of android application package download hijacking, which can be exploited to implement a stealth download hijacking by deploying bypass devices. And the victim sites can hardly notice it by using current methods. The cause, influence and mechanism of the exploit are discussed in this paper, and we also strive to give a solution for it.

Risk assessment of mobile applications based on machine learned malware dataset

With the expected development of the Internet of Things, in which all devices will be connected, mobile devices will play a greater role in providing personalized services and will store larger amounts of personal information. However, the number of malicious applications is also increasing, with the aim being to steal user personal information. Furthermore, given the open-market policies of Android and the distribution structure of the Google Play store, any application developer can readily distribute such applications. On the other hand, end users cannot easily determine whether an application is malicious or not. Therefore, we propose an Android application package (APK) Vulnerability Identification System (AVIS) that can identify malicious applications in advance using the Naive Bayes classification scheme. To achieve this goal, AVIS builds a dataset by downloading sample applications and extracting their framework methods. To verify the accuracy of AVIS, we analyze sample applications. The APK vulnerability score determined by AVIS is expected to be used as a core metric for quantitatively evaluating the vulnerability of mobile applications.