A Hybrid Framework for Detecting Repackaged Applications on the Android Market

Smartphones and tablets have become part of our daily lives. These devices run on two major competing software platforms: Apple's iOS and the Google's Android OS. The popular software design has implemented applications which are purchased by end users. Android apps are mostly purchased through the Google Play Store, while iOS apps are available on Apple's App Store. The apps exclusively have given birth to a new market as well, attracting all kinds of interested users, hackers and cybercriminals. In this paper, we focus on the Android software being more susceptible to attacks through the purchase or download of malicious apps, also known as “repackaged apps.” These are applications containing malicious code and phishing malware that are visually similar to the original app that the end user intended to purchase. The objective of this research is twofold: Our first research goal is to analyze the three state of the art malware detection mechanisms and identify their known vulnerabilities that can be exploited by the existing threats. Our second research goal is to develop a hybrid malware detection framework by combining the strong features of the preexisting schemes. In addition, we show the practicality of our proposed framework by presenting three case studies that demonstrate how different components of our hybrid solution will work together to maximize the malicious-code detection in repackaged applications.