Software Engineering Metrics For Sifting Android Malicious Applications

Software engineering metrics are used to predict the effort/cost and quality of software applications. Measuring software quality helps us find defects and bugs, which in turn leads us to find software vulnerabilities. In addition, these metrics find the structural and behavioral properties of a software program and hence help find clones/variants of the original software program. New malware programs are commonly written by creating clones/variants of the original malware. Software engineering metrics can be effectively used to find such malware. None of the previous research works have employed these metrics for finding Android malicious applications. In this paper, we propose the first such system that uses software engineering metrics for sifting and finding Android malicious applications. We extract these metrics for each reachable method in an Android application. Some of the metrics are, API types, API call in/out, control flow graph size, lines of code, number of branches, and number of invocations. When tested with real Android malware applications our proposed system shows promising results indicating the effectiveness of these features.