Jul 2026· International Scientific Journal of Engineering and Management· Vol 05, pp. 1-9· 1 citation
TL;DR
The Android Malware Detection System provides a comprehensive, reliable, and user-friendly platform to safeguard mobile ecosystems against emerging threats, combining technical rigor with accessibility.
Abstract
ABSTRACT
Python-based web application developed to identify and analyse malicious Android APK files. It integrates static analysis, using Andro guard to extract permissions and metadata, with dynamic analysis, employing Mobs to monitor runtime behaviour in a controlled sandbox environment. This dual-layered approach enables the detection of both overt and hidden threats. At its core, the system leverages a Random Forest classifier trained on labelled datasets of malware and benign applications, providing accurate threat classification along with confidence scoring. The application features a Flask-based web interface that allows secure APK uploads, real-time scanning, and the generation of detailed PDF reports. A history of previous scans is maintained to support long-term tracking and analysis. The technical architecture consists of three main components: a user interface built with HTML, CSS, and Flask templates; a Python backend responsible for feature extraction, safe testing, and machine learning predictions; and an SQLite database for storing results. By automating the identification of dangerous applications, the system addresses critical mobile security challenges. It is designed with scalability in mind, making it easy to expand for future needs such as cloud integration. Built with Python’s security tools and thoroughly tested, the project demonstrates a practical solution to combat evolving Android malware. It ensures usability for both programmers and security experts, combining technical rigor with accessibility. Ultimately, the Android Malware Detection System provides a comprehensive, reliable, and user-friendly platform to safeguard mobile ecosystems against emerging threats.
The Android platform accounts for the overwhelming majority of mobile devices in use worldwide, and that dominance has made it the principal target for authors of mobile malware [1], [2]. Applications distributed outside curated stores routinely abuse the permission model, conceal payloads behind obfuscation, or masquerade as repackaged versions of trusted banking and utility software. Detection schemes built on static signatures cannot follow threats that mutate between releases, and while machine learning classifiers have improved raw detection rates considerably, most of them return a bare verdict that an analyst has no means of interrogating. This paper describes a static analysis framework for Android malware detection that couples a LightGBM classifier with SHapley Additive exPlanations and a mapping layer built on the MITRE ATT&CK knowledge base. Features are drawn exclusively from the application manifest, which keeps extraction inexpensive and avoids the provenance artefacts observed when heterogeneous feature families are combined. Trained and evaluated on the AndroMD dataset and benchmarked against XGBoost, Random Forest and CatBoost under identical conditions, the proposed model attained 99.13% accuracy, a 99.84% ROC-AUC and a Matthews correlation coefficient of 98.26% while completing training in 27.84 seconds, between forty and fifty-nine per cent faster than the competing ensembles. Every prediction is accompanied by a per-sample attribution identifying the permissions responsible for it, and samples judged malicious are additionally mapped onto adversary tactics and techniques. The pipeline is delivered as a Flask application, APKGuard, which accepts an uploaded package and returns a scored verdict, an explanation and a behavioural summary in a single pass.
Pavitra Murapala, L. Dr.· International Journal of Inn...· 0 citations
This work compiled a dataset of benign and malicious APKs and performed static analysis to extract features such as code structure, permissions, and manifest file content, without executing the apps, and used an LLM to generate high-level functional descriptions of APKs.
Saraga Sakthidharan, S. Anagha, Dincy R. Arikkat et al.· International Journal of Inf...· 1 citation
The results have shown how well-engineered static features coupled with overfitting-aware ensemble design can give robust results of multi-class malware classification in the absence of dynamic traces, to develop additional resilience from obfuscation and runtime-evasive threats.
H. Lamkuche, Mannat Pal· Journal of Computer Virology...· 0 citations
The rapid growth of Android applications has significantly increased the risk of malware capable of
intercepting SMS-based One-Time Passwords (OTPs), leading to financial fraud, identity theft, and unauthorized access
to sensitive user accounts. Traditional Android malware detection approaches primarily rely on static permission analysis
or signature-based detection techniques, which are often insufficient to identify emerging malware variants and
applications requesting excessive sensitive permissions. To address these limitations, this paper proposes a Hybrid Static–
Dynamic Analysis Framework for Detecting SMS-OTP Interception Malware on Android Devices. The proposed
framework integrates Python, Flask, Androguard, Android Studio, Java, Android SDK, and Android PackageManager
APIs to perform APK analysis, permission extraction, installed application analysis, risk score calculation, and security
report generation. Static analysis examines uploaded APK files by extracting manifest information, application
components, and sensitive permissions, while the device-level analysis module evaluates installed Android applications
using PackageManager APIs to identify risky permissions and calculate security scores. The framework classifies
applications into Safe, Medium Risk, and High Risk categories based on predefined risk assessment rules and generates
comprehensive security reports for end users. Experimental results demonstrate that the proposed framework effectively
identifies security-sensitive applications, improves Android security awareness, and provides an economical solution for
Android malware assessment suitable for academic research and practical mobile security applications.
R. Sridevi, Soumya Erra· International Journal of Inn...· 0 citations
Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance.
Vani Pasupula, M. N. V. Manikanth, Nagaraju Vassey· International Journal of Cre...· 0 citations
Android operating system has taken over the mobile ecosystem across the world and thus is a prime target of more advanced malware that uses its ability to obfuscate, dynamically load code, encrypted communications and even environment aware evasion behaviors. These properties severely circumscribe the ability of conventional signature-based detection systems, and are problematic to either all-static or all-dynamic analysis. Although machine learning-based detection methods have promise, most current solutions are black-box systems with no forensic transparency [5][6] , and are not as applicable in security operations and digital investigations.
This paper presents an android malware detection system being a hybrid between the static-dynamic framework and powered by Indicators of Compromise (IoCs) and machine learning. The framework uses a constrained dual-VM setup consisting of an analysis host based on Ubuntu and an instrumented android emulator. Standard analysis tools are used to extract the static IoCs, which consist of permissions, manifest components, use of sensitive APIs, cryptographic artifacts, certificate metadata, and embedded network indicators. Controlled application execution can be used to obtain dynamic IoCs by monitoring and instrumenting runtime behaviors related to behavioural indicators like network communication, filesystem activity and sensitive API invocation.
A framework IoC correlation and normalization engine is used to combine heterogeneous non-uniform indicators which are static and dynamic, into structured feature vectors. A random Forest model that has been chosen due to its strong ability to predict high-dimensional data, as well as the ability to have an interpretable component, are used to classify these vectors. In addition to binary classification, the framework produces a structured forensic intelligence report, which records the IoCs behind each detection decision, which in turn facilitates evidence-based and explainable malware detection.
The suggested framework puts the emphasis on the detectability, interpretability and forensic relevance. It improves resilience to evasion by obfuscation, but does not increase decision-making transparency through the correlation of fixating and moving IoCs. The work provides an expandable and explainable android malware detection architecture that can be used in academic research, enterprise security operations, and advanced digital forensic investigation, and which may be extended in the future to the scale of validation and on-device detection.
V. V. Rao· i-manager's Journal on Compu...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
