Malware detection using static analysis in Android: a review of FeCO (features, classification, and obfuscation)

Rosmalissa Jusoh; Ahmad Firdaus; Shahid Anwar; Mohd Zamri Osman; Mohd Faaizie Darmawan; Mohd Faizal Ab Razak

doi:10.7717/peerj-cs.522

Malware detection using static analysis in Android: a review of FeCO (features, classification, and obfuscation)

PeerJ Comput Sci. 2021 Jun 11:7:e522. doi: 10.7717/peerj-cs.522. eCollection 2021.

Authors

Rosmalissa Jusoh¹, Ahmad Firdaus¹, Shahid Anwar², Mohd Zamri Osman¹, Mohd Faaizie Darmawan³, Mohd Faizal Ab Razak¹

Affiliations

¹ Faculty of Computing, College of Computing and Applied Sciences, Universiti Malaysia Pahang, Pekan, Pahang, Malaysia.
² Department of Information Engineering Technology, National Skills University, Islamabad, Pakistan.
³ Faculty of Computer & Mathematical Sciences, Universiti Teknologi Mara, Tapah, Perak, Malaysia.

Abstract

Android is a free open-source operating system (OS), which allows an in-depth understanding of its architecture. Therefore, many manufacturers are utilizing this OS to produce mobile devices (smartphones, smartwatch, and smart glasses) in different brands, including Google Pixel, Motorola, Samsung, and Sony. Notably, the employment of OS leads to a rapid increase in the number of Android users. However, unethical authors tend to develop malware in the devices for wealth, fame, or private purposes. Although practitioners conduct intrusion detection analyses, such as static analysis, there is an inadequate number of review articles discussing the research efforts on this type of analysis. Therefore, this study discusses the articles published from 2009 until 2019 and analyses the steps in the static analysis (reverse engineer, features, and classification) with taxonomy. Following that, the research issue in static analysis is also highlighted. Overall, this study serves as the guidance for novice security practitioners and expert researchers in the proposal of novel research to detect malware through static analysis.

Keywords: Android; Features; Machine learning; Malware; Review; Static analysis.

Grants and funding

This work was supported by the Ministry of Higher Education (MOHE) for Fundamental Research Grant Scheme (FRGS) with grant number RDU190190, FRGS/1/2018/ICT02/UMP/02/13, and Universiti Malaysia Pahang (UMP) internal grant with grant number RDU1803142. The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.