Android Market Research Articles

DCM-GIFT: An Android malware dynamic classification method based on gray-scale image and feature-selection tree

Context:The boom of Android market makes mobile products more popular and convenient. However, in the face of the complex Android application market, how to efficiently and accurately identify malware has become one of the focuses of research. Various new types of disguised malware lurk in the web pages, links and major application malls. Therefore, people’s privacy and property security have become a major obstacle to the continued development of mobile devices. Objective:Most of the existing malware classification methods are fixed on one or several types of characteristics of Android devices, such as static characteristics, dynamic characteristics and traffic characteristics. Single feature detection or fixed feature fusion models limit the dimension of detection software, and also cause imbalanced classification results. This paper proposes an Android Malware Dynamic Classification Method based on Gray-scale Image and Feature-selection Tree (DCM-GIFT), which aims to improve and stabilize the precision of Android software classification and enhance the robustness of malware classification. Method:In this paper, we construct gray-scale images for the original Android traffic to retain the characteristics of the time series and spatial structure of the original network traffic. At the same time, we take the dynamic information and static information of Android software as auxiliary features to build a feature selection tree. The feature-selection algorithm helps the classifier dynamically select the optimal feature fusion scheme, and the resulting fusion feature vector will be trained and predicted using machine learning clusters for model training. Results:We evaluate the performance of DCM-GIFT on multiple datasets published at the Canadian Institute for Cybersecurity, the area under the accuracy, precision, recall and F1measure. The results show that the proposed DCM-GIFT model has significantly better prediction performance compared to other software classification models. Conclusion:It can be concluded that: (1) In terms of accuracy, precision, recall and F1measure, the DCM-GIFT model has a higher average value. (2) The DCM-GIFT model effectively solves the problem of imbalanced classification results in Android software. (3) The DCM-GIFT model achieves the goal of dynamic feature fusion and significantly improves the utilization of system resources.

KTSDroid: A Framework for Android Malware Categorization Using the Kernel Task Structure

The penetration of malicious applications in the Android market has enhanced the significance of designing malware mitigation systems for Android. Malware detection systems are being developed by examining applications using static and dynamic analysis techniques. The use of code obfuscation has highlighted the importance of dynamic analysis as many static analysis schemes can be evaded by code obfuscation strategies. In order to record the true working of the application, a volatile memory-based solution for application analysis is presented in this study. Time-based memory dumps are collected after interactions with an application. Process-specific artifacts of the application under analysis are extracted by examining the kernel task structure of memory. The features in the kernel task structure belong to nine broad categories based on their semantics. An important contribution of the study is the analysis of the kernel task structure for determining the set of effective categories and features for Android malware categorization. Three of the most important categories and fourteen valuable features are reported. The proposed system categorizes the applications into five classes: adware, banking Trojans, riskware, SMS Trojans, and benign. The proposed system is able to categorize applications with an average F1-score of 0.984, which is the highest score reported so far for multiclass Android malware categorization with a minimum number of kernel task structure-based features.

Test Report Generation for Android App Testing Via Heterogeneous Data Analysis

The rising of the Android market demands higher quality assurance of Android applications (apps) to sharpen the competitive edge, and techniques for traditional software have problems adapting for mobile apps. Android apps often require testing on a large-scale device cluster, which produces a large amount of test reports consisting of heterogeneous data, e.g., hardware information, GUI screenshots, runtime logs. Such data are hard to merge to be unified analyzed, while they serve as an essential basis for bug inspection and fixing. Existing test report generation or analysis techniques can only handle testing data from different devices separately. They simply list all the information to app developers and have no further processing to summarize test reports. Besides, they neglect the inner connection of the heterogeneous data. Such techniques cannot improve the report reviewing effectiveness and efficiency, and they can hardly find the inner links and rules of the bug occurrence on different devices. As a result, developers still need to devote many efforts to inspect and fix bugs. In this paper, a large amount of test reports are investigated by the authors, as to construct a structured bug model to analyze heterogeneous data of the testing results. According to the investigation, we also define the <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Bug Inconsistency</small> of testing results from multiple devices and build a novel bug taxonomy. In general, an automated approach is proposed to generate structured and comprehensible test reports from raw testing results from multiple devices. Based on the approach, a tool, namely <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">BreGat</small> , is implemented to evaluate the classification and deduplication capability of our approach. The experimental results of 30 Android apps on 20 devices show that <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">BreGat</small> can successfully cover 83% bug categories and exclude 76% duplicate bugs. Furthermore, a user study involving 16 developers shows that our test reports are more comprehensible and <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">BreGat</small> greatly improves the bug inspection efficiency compared to the state-of-the-art tool.

Telepsychological Mobile Applications in the Spanish Android Market.

The use of Android mobile applications aimed at addressing users' psychological health is increasing. However, no review has been conducted on public Android commercial telepsychological applications in Spain. A systematic search was carried out in the general applications section of Google Play Store based on 20 keywords in Spanish. Applications in Spanish or English that were relevant from the perspective of the search terms were included in the analysis. Of the 1,000 applications retrieved, only 43.59% (337/773) met the inclusion criteria, of which 49.26% (171/337) were Spanish. Most of them were Self-applied treatment applications (52.96%, 29.59%, Spanish; 23.37%, English). A total of 69.44% (37.38% Spanish; 31.95% English) did not indicate the origin of the information and the academic link was anecdotal (3.25%). The low percentage of relevant applications, high prevalence of self-help applications, absence of references on the origin of the information, absence of academic support, and lack of certifications encouraged us to recommend caution to consumers and professionals in their adoption of these applications for the treatment of any psychological disorder.

Analysing Content Ratings of Google Apps with Ensemble Learning

Google Play was launched under the name of Android Market and made its reputation known all over the world. The mobile application market, which is a package manager developed by Google for Android users, contains applications that appeal to many areas and age ranges. The wide area in which applications spread and the data flow, which has reached the level of being called “big data”, has started to attract the attention of researchers. The excessive increase in the number of applications makes it difficult for parents to follow up on the content. In order to provide content rating of applications on Google Play, it is needed to be classified by machine learning methods. In this study, content rating classification was made by analyzing “Category, Rating, Reviews, Size, Installs, Type, Genres, Last Updated, Current Version, Android Version” features of 10757 applications on Google Play, Ensemble Learning methods (Adaboost, Bagging, Random Forest, Stacking), Logistic Regression, Artificial Neural Network, K-Nearest Neighbors algorithms.

Search Rank Fraud and Malware Detection in Mobile Apps

Abstract:The financial success of Android software stores like Google Play, as well as the incentive scheme they provide for popular apps, make them attractive targets for fraud and malicious behavior. Some fraudulent developers deceptively boost the search rank and popularity of their apps while malicious developers use app markets as a launch pad for their malware. In this project, introduce FairPlay, a novel system that discovers and leverages traces left behind by fraudsters, to detect both malware and apps subjected to search rank fraud. FairPlay correlates review activities and uniquely combines detected review relations with linguistic and behavioral signals gleaned from Google Play app data in order to identify suspicious apps. Adversaries can have chances to launch attacks by gathering victim’s information continuously. This project shows that an adversary can successfully infer a victim’s vertex identity and community identity by the knowledge of degrees within a time period. The project also includes a new supervised clustering algorithm to find groups of data (coarse and finer cluster). It directly incorporates the information of sample categories into the fraud clustering process. Keywords: -Android market, search rank fraud, malware detection.

Non-Functional Requirements Analysis Based on Application Reviews in the Android App Market

There are more than 3 million mobile apps in the Android market. The development process of every mobile application is rigorous, and many types of research on application quality requirements are derived, which are highly related to the development of applications. Research shows that user reviews of mobile applications are an unused large database that can provide feedback on user needs. In this article, user comments are automatically classified into non-functional requirements (NFRs) and other types. This paper proposes a loop matching classification technique (Loop Matching Classification). The three classification techniques of LMC, BOW, and TF-IDF were used to classify user comments, and the accuracy, recall rate, and F-measure of the results of the three classification techniques were compared. It was found that the Precision value of the LMC classification technique was 74.2%, the Recall was 82.5% and the F-measure was 78.1%.

A Comparison of Functional Features of Chinese and US Mobile Apps for Pregnancy and Postnatal Care: A Systematic App Store Search and Content Analysis.

BackgroundPregnancy to postpartum (PtP) applications (apps) are becoming more common tools to document everything from pregnancy and delivery to nutrient allocation, life taboos, and infant medical examinations. However, the dependability, quality, and efficacy of these apps remain unclear. This study examined the features and functions of mobile PtP care apps accessible in China and the United States and to identify the major gaps that need to be addressed.MethodsApps were selected by searching the Apple App Store and Android Markets (in the US and China) for the terms “pregnancy” and “postpartum” in Chinese and English. The apps' security, quality, and effectiveness were investigated, and chi-square tests and analysis of variance were performed to examine the differences in characteristics between apps available in the US and China.ResultsA total of 84 mobile PtP care apps (45 from the US and 39 from China) were included. A total of 89.7% (35/39) of Chinese mobile apps did not provide safety statements or supporting evidence. The objective app quality ratings for Chinese and US apps were 3.20 ± 0.48 (mean ± standard deviation) and 3.56 ± 0.45, respectively (p > 0.05). A greater number of Chinese apps provided app-based monitoring functions, namely recording fetal size (n = 18, 46.2% in China vs. n = 3, 6.7% in the US), contractions (n = 11, 28.2% in China vs. n = 0, 0% in the US), pregnancy weight (n = 11, 28.2% in China vs. 0, 0% in the US), and pregnancy check-up reminders (n = 10, 25.6% in China vs. n = 0, 0% in the US). Meanwhile, a greater number of US apps provided exercise modules, namely pregnancy yoga (n = 2, 5.1% in China vs. n = 21, 46.7% in the US), pregnancy workouts (n = 2, 5.1% in China vs. n = 13, 28.9% in the US), and pregnancy meditation (n = 0, 0% in China vs. 10, 22.2% in the US) (p < 0.01). A medium security risk was identified for 40% (18/45) of apps in the US and 82.1% (32/39) of apps in China (p < 0.01).ConclusionsThe functionality and characteristics of in-store mobile apps for PtP care varied between China and the US. Both countries' apps, particularly Chinese apps, encountered issues related to a lack of evidence-based information, acceptable content risk, and program evaluations. Both countries' apps lacked proper mental health care functions. The findings suggest that the design of app features should be enhanced in both countries, and increased interaction between app creators and users is recommended.

A Study on Temporal Effects of Different Types of Mobile Application Updates

The sustainability of market performance of mobile applications (apps) updates is a vital goal for e-commerce firms to continuously innovate for products and functions. E-commerce firms must formulate effective app update strategies and tackle the temporal uncertainties associated with different types of app updates. However, the existing literature on app updates mainly focuses on the effects of update frequency. At the same time, scant attention has been paid to clarifying the temporal effects of different types of app updates. Accordingly, based on the framework of exploration vs. exploitation, we investigate the temporal effects of different kinds of app updates on market performance in the hypercompetitive context of online travel mobile applications. We collected data on release notes and downloads of seven Chinese online travel apps available from the Android Market from April 2013 to January 2015; conducted structured content analysis to identify different types of app updates; and adopted the feasible generalized least-squares (FGLS) estimation to test our model. We found that exploitative app updates have an instant and continuous positive impact on market performance, while explorative app updates have no significant effect in the short term but will have a positive effect on market performance in the long term. Moreover, competition intensity shortens the duration of the positive effect of exploitative app updates and delays the time that explorative app updates have to take effect. By studying the different impacts that two types of app updates have on market performance from a time dimension, this study helps resolve the mixed findings on the effects of app updates and guides e-commerce firms on how to effectively formulate app update strategies in a hypercompetitive context.

IoT-based Cloud Service for Secured Android Markets using PDG-based Deep Learning Classification

Software piracy is an act of illegal stealing and distributing commercial software either for revenue or identify theft. Pirated applications on Android app stores are harming developers and their users by clone scammers. The scammers usually generate pirated versions of the same applications and publish them in different open-source app stores. There is no centralized system between these app stores to prevent scammers from publishing pirated applications. As most of the app stores are hosted on cloud storage, therefore a cloud-based interaction system can prevent scammers from publishing pirated applications. In this paper, we proposed IoT-based cloud architecture for clone detection using program dependency analysis. First, the newly submitted APK and possible original files are selected from app stores. The APK Extractor and JDEX decompiler extract APK and DEX files for Java source code analysis. The dependency graphs of Java files are generated to extract a set of weighted features. The Stacked-Long Short-Term Memory (S-LSTM) deep learning model is designed to predict possible clones. Experimental results have shown that the proposed approach can achieve an average accuracy of 95.48% among clones from different application stores.

Smartphone-Based Passive Sensing for Behavioral and Physical Monitoring in Free-Life Conditions: Technical Usability Study.

Smartphone use is widely spreading in society. Their embedded functions and sensors may play an important role in therapy monitoring and planning. However, the use of smartphones for intrapersonal behavioral and physical monitoring is not yet fully supported by adequate studies addressing technical reliability and acceptance. The objective of this paper is to identify and discuss technical issues that may impact on the wide use of smartphones as clinical monitoring tools. The focus is on the quality of the data and transparency of the acquisition process. QuantifyMyPerson is a platform for continuous monitoring of smartphone use and embedded sensors data. The platform consists of an app for data acquisition, a backend cloud server for data storage and processing, and a web-based dashboard for data management and visualization. The data processing aims to extract meaningful features for the description of daily life such as phone status, calls, app use, GPS, and accelerometer data. A total of health subjects installed the app on their smartphones, running it for 7 months. The acquired data were analyzed to assess impact on smartphone performance (ie, battery consumption and anomalies in functioning) and data integrity. Relevance of the selected features in describing changes in daily life was assessed through the computation of a k-nearest neighbors global anomaly score to detect days that differ from others. The effectiveness of smartphone-based monitoring depends on the acceptability and interoperability of the system as user retention and data integrity are key aspects. Acceptability was confirmed by the full transparency of the app and the absence of any conflicts with daily smartphone use. The only perceived issue was the battery consumption even though the trend of battery drain with and without the app running was comparable. Regarding interoperability, the app was successfully installed and run on several Android brands. The study shows that some smartphone manufacturers implement power-saving policies not allowing continuous sensor data acquisition and impacting integrity. Data integrity was 96% on smartphones whose power-saving policies do not impact the embedded sensor management and 84% overall. The main technological barriers to continuous behavioral and physical monitoring (ie, battery consumption and power-saving policies of manufacturers) may be overcome. Battery consumption increase is mainly due to GPS triangulation and may be limited, while data missing because of power-saving policies are related only to periods of nonuse of the phone since the embedded sensors are reactivated by any smartphone event. Overall, smartphone-based passive sensing is fully feasible and scalable despite the Android market fragmentation.

Study of Sentiment on Google Play Store Applications

This paper proposes an approach to perform sentiment analysis on Google play store’s applications considering Kaggle dataset. The dataset includes 10,000 applications with their ratings, reviews, number of download and other application related parameters. The dataset is pre-processed using a number of data cleaning steps, including data reduction, tokenization, stemming etc. For classification of sentiment polarity, a logistic regression model has been proposed. The logistic regression model has been extended to a tri-polar classifier. Accuracy of 81.1% was achieved for document-level classification of reviews. The top two applications, ‘Candy Crush Saga’ and ‘Clash of Clans’, have been selected for the analysis based on popularity. Even though the ‘family’ category has a higher number of applications on the store, games are much more popular on Google's play store. Results show that these apps, though popular, receive a higher number of negative reviews. The sentiment of play store users gives us an idea of how the applications market reacts, what are the needs and how to succeed in the android market. The opinion of the audience is an essential component for every business. These reviews prove to be useful for further development and improvement of the applications.

A Dynamic Robust DL-Based Model for Android Malware Detection

The dramatic increase in Android-based smart devices has brought technological revolution to improve the overall quality of life and thus making it worth a billion-dollar market. Despite the huge hype surrounding Android market, the prevalent and potentially sophisticated malicious mobile malware has become a serious threat to the popular Android platform and an ideal target for varied cyber adversaries. Conversely, multivector malware efficient and timely detection is extremely challenging because it usually hides itself under legitimate third party software’s and having the capability to be easily crafted on any executable file extension. To better streamline this complex issue of paramount concern, the authors propose a highly proficient hybrid deep learning (DL)-enabled intelligent multi-vector malware detection mechanism. The devised approach leverages Convolutional Neural Networks and Bidirectional Long Short-Term Memory (BiLSTM) to efficiently identify persistent malware. The proposed technique has been thoroughly evaluated with publicly available datasets, standard performance metrics, and state-of-the-art hybrid DL-driven architectures and benchmark DL algorithms. Besides, the proposed framework has been cross-validated and shows out performance both in terms of time efficiency and detection accuracy.

PAM Clustering Aided Android Malicious Apps Detection

The exponential growth of android contrivances has attracted cybercriminals strongly and dramatically. The applications existed in the android market represented an attack surface owing to the lack of security mechanisms applied by the Google play store. Additionally, downloading apps from unofficial sources lead to a further security threat. Any mobile application requests several permissions to access users’ data to run the app. Thus, attackers exploited this feature in compromising users’ sensitive data. This motivated several researchers to investigate security mechanisms to detect Android malware based on this feature utilizing machine learning techniques, particularly classification techniques. However, This research proposes a permission-based android malware detection framework using a clustering algorithm. Further motivation for this research is that large datasets labeling is a tough mission. Therefore, Our work will contribute to android malware detection as well as android apps datasets labeling. PAM (Partitioning Around Medoid) clustering has been exploited for this purpose since its less affected by outliers or other extreme values. The most significant features have been selected as an input to the clustering algorithm to enhance its results. The results depicted that our clustering algorithm was able from grouping our dataset into two categories malevolent and genuine apps. Moreover, our result has been validated by evaluation standard F-Measure, which is counting for 0.86 for 40 attributes subset, while it is 0.88 for 30 features subset. This reveals a good performance level of permission-based android malware detection and android applications datasets labeling into malware and good ware.

Large-Scale Third-Party Library Detection in Android Markets

With the thriving of mobile app markets, third-party libraries are pervasively used in Android applications. The libraries provide functionalities such as advertising, location, and social networking services, making app development much more productive. However, the spread of vulnerable and harmful third-party libraries can also hurt the mobile ecosystem, leading to various security problems. Therefore, third-party library identification has emerged as an important problem, being the basis of many security applications such as repackaging detection, vulnerability identification, and malware analysis. Previously, we proposed a novel approach to identifying third-party Android libraries at a massive scale. Our method uses the internal code dependencies of an app to recognize library candidates and further classify them. With a fine-grained feature hashing strategy, we can better handle code whose package and method names are obfuscated than historical work. We have developed a prototypical tool called LibD and evaluated it with an up-to-date dataset containing 1,427,395 Android apps. Our experiment results show that LibD outperforms existing tools in detecting multi-package third-party libraries with the presence of name-based obfuscation, leading to significantly improved precision without the loss of scalability. In this paper, we extend our early work by investigating the possibility of employing effective and scalable library detection to boost the performance of large-scale app analyses in the real world. We show that the technique of LibD can be used to accelerate whole-app Android vulnerability detection and quickly identify variants of vulnerable third-party libraries. This extension paper sheds light on the practical value of our previous research.

The current status of stroke-related smartphone applications available to adopt in China: A systematic review study.

Introduction:Stroke-related smartphone applications (apps) present enormous potential for stroke management as apps become increasingly prevalent in China. However, there is no comprehensive study reported about the currents status of stroke-related apps available to adopt in Chinese app market. The aim of this study is to assess the current status of stroke-related apps available to adopt in China.Materials and Methods:Using Stroke-related keywords written in either Chinese or English, the top 6 most prevalent apps online stores in China were searched from June to August 2018, including android market, 360 app market, wan dou jia, baidu mobile app, ying yong bao, apple app store. The basic features of selected apps were analyzed based on operating system, cost, target people, engagement, online interaction, release date, size, popularity, and usefulness. The information accountability of selected apps was evaluated with the Silberg scale. The functionality of selected apps targeting stroke patients at home were reviewed by researchers.Results:Our study showed that the downloads of stroke-related apps from android platform and the engagement of health professionals in apps development were critically insufficient. And most apps didn’t offer a platform to facilitate online interaction with health professional. The information accountability of apps also presented a huge room for improvement. The average Silberg score of 127 apps was 3.5 (out of 9) with most apps not disclosing sponsorship, authors’ affiliations, credentials, and sources or references of information. Few apps were modified in the past months. What's more, although the apps targeting stroke patients at home have covered 9 functionalities, most apps had only a simple functionality.Conclusion:This study identified areas for improvement concerning information accountability of stroke-related apps available for adoption in China and reviewed functionality of apps targeting stroke patients at home. The findings might guide the development for stroke-related apps in China in the future.

Smartphone Confrontational Applications and Security Issues

In today's society, there is a high volume of smartphones, with Android being the most popular and most commonly used smartphones. In the last few years, the Android market has been booming, making lots of developers join the industry so as to create various mobile applications that are a benefit to people's lives. However, its over-popularity has brought many crime issues, including security. One of the major common incidents to mobile users is having their mobile phones lost or stolen. Since most mobile users want to find their lost phones, they are looking for the most reliable features that can help them locate their smartphones. Luckily, there are some developed applications and services that have been designed to track down and locate lost or stolen smartphones. In this work, the authors tried to identify a collection of these applications and the information they send to the user in aiding them to find their phone. Since some applications are able to send location information or a photo, this work will look at what metadata is usually sent with the message.

A Security Framework for Mobile Application Systems: Case of Android Applications.

Smartphones have become a major part of human’s life. And also it has been seen that new mobile applications are built day by day. Currently mobile applications are playing major role in many areas such as banking, social networking, financial apps, entertainment and many more. With this increasing number of applications, security is an important issue. The growth of android market has increased security risk and thus focus should be given to the security. Security is the biggest issue in the field of mobile technology. Therefore, mobile applications need to be assessed and ensure that secure coding practices have been followed during development. Mobile application security breach can lead to fraudulent transactions through mobile applications, confidentiality and revenue loss through communications services misuse. Data that is shared on an unsecured channel is vulnerable to attacks and to stop unauthorized access to this data, there is need to encrypt the data before it is sent to the server. In this research work, different cryptographic algorithms for encrypting data and secure data sharing in mobile applications across communications channels were examined. Simulation methodology was used to investigate a suitable cryptographic algorithm and to design a security framework for mobile applications to solve mobile application security problems. The proposed framework employs the use of Advanced Encryption Standard (AES) algorithm for encrypting meter readings data being exchanged between a smart phone and the server. The results obtained from the simulation of the security framework, showed that the four fields namely: Account number, image path, meter number and phone number on which AES encryption was applied were in an unreadable format (ciphertext), implying that the fields have been successfully encrypted. This solution allows application users to transfer (upload readings) data between a smart phone and database server in a secure manner without facing the problem of data attack. Data being uploaded to the server is encrypted before it is transferred and decrypted once it reaches the server side. This solution addresses android application security in the application and network communications layers and data transmission. The research paper ensures information security is guaranteed between an organisation and its customers.

An adaptive framework against android privilege escalation threats using deep learning and semi-supervised approaches

The immense popularity of Android makes it a primary target of malicious attackers and developers which brings a significant threat from malicious applications for android users through the escalation of the abuse of android permissions and inter-component communication (ICC) mechanism. Therefore, protecting android users from malicious developers and applications is crucial for Android market and communities. As malicious applications can hide their malicious behavior and change the behaviors frequently by abusing the android’s ICC mechanism and related vulnerabilities, it is a challenging task to identify them accurately before it becomes a prevalent reason for users’ privacy and data breach. Therefore, it is essential to develop such a malware detection engine that will ensure zero-day detection. In this research, we propose an adaptive framework which can learn the behavior of malware from the usage of permissions and their escalations. For our adaptive framework, we proposed two different detection models using deep learning and semi-supervised approaches. The proposed detection models can extract knowledge from unlabeled apps to identify the new malicious behavior using the unsupervised training nature of deep learning and clustering techniques and their integration to the supervised detection engine. Thus, our adaptive framework learns about new malicious apps and their behavior without supervised labeling by manual expert and can ensure zero-day protection. The proposed detection models have been tested on a real mobile malware test-bed and data set. The Experimental results show that the deep learning and semi-supervised based models achieve 99.024% of accuracies, more effective for zero-day protection and outperform other existing supervised detection engines.

Android application security: detecting Android malware and evaluating anti-malware software

Mobile devices have become widespread computing technology, people prefer to use than desktop devices. These connected devices and their features like an exchange of data, video calling etc. have made our lives simple but, this has also increased data security concerns. At present, Google's Android is dominating the market share of mobile devices; as a result, it has become a big target for malware writers. Android users can download applications from official or third-party stores. Google implements various security policies to ensure secure distribution of applications but third-party application stores have less efficient or no such policies. This makes such markets more attractive for malware writers. This paper investigates Android application security by analysing 1,946 free most downloaded Android applications in the year 2016: 1,300 from Google Play Store and 646 from third-party Android applications. 100 samples from 33 different malware families (with variants) prominent in the Android market during January 2016 to April 2016 were also collected that acted as a template for malware detection. Further, based on detected malware samples, an evaluation-based study on ten anti-malware applications is performed to identify how well they protect users from malware.