The exponential growth of Android applications has resulted in a surge of malware threats, posing severe risks to user privacy and data security. To address these challenges, this study introduces a novel malware detection approach utilizing an ensemble of Convolutional Neural Networks (CNNs) for enhanced classification accuracy. The methodology incorporates a multi-phase process, starting with the extraction and preprocessing of APK (Android app) files. The preprocessing phase involves decompressing, decompiling, and transforming the APK files into bytecode and Dex files. The extracted byte data is converted into 1D vectors and reshaped into 2D grayscale images, enabling efficient feature learning through CNNs. The proposed ensemble of CNN-based models undergoes comprehensive training, validation, and evaluation, demonstrating superior performance compared to existing approaches. We used two popular Android datasets to evaluate the performance of our proposed model. Specifically, the model achieves an accuracy of 98.65%, F1-score of 96.43% on the Drebin dataset and attains 97.91% accuracy, 96.73% of F1-score on the AMD dataset. These results confirm the model’s ability to effectively identify Android malware with high precision and reliability, outperforming traditional techniques. This research not only underscores the potential of our proposed approach in malware detection but also sets a foundation for future advancements. Future efforts will focus on real-time malware detection, integration with mobile security frameworks, and evaluation across diverse datasets to ensure adaptability to emerging malware threats.

Metamorphism is a technique that mutates the binary code using different obfuscations and never keeps the same sequence of opcodes in the memory. This stealth technique provides the capability to a malware for evading detection by simple signature-based (such as instruction sequences, byte sequences and string signatures) anti-malware programs. In this paper, we present a new scheme named Annotated Control Flow Graph (ACFG) to efficiently detect such kinds of malware. ACFG is built by annotating CFG of a binary program and is used for graph and pattern matching to analyse and detect metamorphic malware. We also optimize the runtime of malware detection through parallelization and ACFG reduction, maintaining the same accuracy (without ACFG reduction) for malware detection. ACFG proposed in this paper: (i) captures the control flow semantics of a program; (ii) provides a faster matching of ACFGs and can handle malware with smaller CFGs, compared with other such techniques, without compromising the accuracy; (iii) contains more information and hence provides more accuracy than a CFG. Experimental evaluation of the proposed scheme using an existing dataset yields malware detection rate of 98.9% and false positive rate of 4.5%.

Android has provided dynamic code loading (DCL) since API level one. DCL allows an app developer to load additional code at runtime. DCL raises numerous challenges with regards to security and accountability analysis of apps. While previous studies have investigated DCL on Android, in this paper we formulate and answer three critical questions that are missing from previous studies: (1) Where does the loaded code come from (remotely fetched or locally packaged), and who is the responsible entity to invoke its functionality? (2) In what ways is DCL utilized to harden mobile apps, specifically, application obfuscation? (3) What are the security risks and implications that can be found from DCL in off-the-shelf apps? We design and implement DyDroid, a system which uses both dynamic and static analysis to analyze dynamically loaded code. Dynamic analysis is used to automatically exercise apps, capture DCL behavior, and intercept the loaded code. Static analysis is used to investigate malicious behavior and privacy leakage in that dynamically loaded code. We have used DyDroid to analyze over 46K apps with little manual intervention, allowing us to conduct a large-scale measurement to investigate five aspects of DCL, such as source identification, malware detection, vulnerability analysis, obfuscation analysis, and privacy tracking analysis. We have several interesting findings. (1) 27 apps are found to violate the content policy of Google Play by executing code downloaded from remote servers. (2) We determine the distribution, pros/cons, and implications of several common obfuscation methods, including DEX encryption/loading. (3) DCL's stealthiness enables it to be a channel to deploy malware, and we find 87 apps loading malicious binaries which are not detected by existing antivirus tools. (4) We found 14 apps that are vulnerable to code injection attacks due to dynamically loading code which is writable by other apps. (5) DCL is mainly used by third-party SDKs, meaning that app developers may not know what sort of sensitive functionality is injected into their apps.