Android is currently one of the most popular smartphone operating systems. Many application developers have been enticed by the enormous demand for mobile smartphone devices. The availability of reverse engineering tools for Android applications, however, also attracted virus authors' and plagiarists' attention. Cloning of applications has been a significant challenge to the Android market in recent years. However, Android accounts for the lion's share of all mobile malware globally, and its security vulnerabilities have garnered a lot of public attention. In this research, we look into how to recognize known Android malware using a clone detector. We compile a set of Android programs known to be malicious as well as a set of good programs. NiCad, a near-miss clone detector, is used to locate the classes of clones in a small fraction of the malicious programs after we retrieve the Java source code from the dex (Dalvik Executable file) file of the applications. The remaining malicious programs' source files are then searched for using these clone classes as a signature. As a control group, the non-harmful collection is utilized. In our analysis, we were able to decompile over 100 potentially harmful programs from 19 different malware families. According to our findings, a small sample of malicious programs can be used as a training set to detect 95% of known malware with a 96.88% accuracy rate and extremely few false positives. Our technique can successfully and consistently identify detrimental programs that are part of specific malware families. Moreover, illegal distribution is another part of software piracy, which is also a prevalent issue in the IT industry. We described an algorithm for the Android library licensing improvement to give insights to a developer on enhancing security measures to prevent the illegal distribution of individual Android applications.
Read full abstract