{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,13]],"date-time":"2026-05-13T17:45:32Z","timestamp":1778694332412,"version":"3.51.4"},"publisher-location":"Cham","reference-count":57,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319264486","type":"print"},{"value":"9783319264509","type":"electronic"}],"license":[{"start":{"date-parts":[[2015,12,20]],"date-time":"2015-12-20T00:00:00Z","timestamp":1450569600000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2016]]},"DOI":"10.1007\/978-3-319-26450-9_20","type":"book-chapter","created":{"date-parts":[[2015,12,19]],"date-time":"2015-12-19T00:51:32Z","timestamp":1450486292000},"page":"519-552","source":"Crossref","is-referenced-by-count":14,"title":["DroidAnalyst: Synergic App Framework for Static and Dynamic App Analysis"],"prefix":"10.1007","author":[{"given":"Parvez","family":"Faruki","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shweta","family":"Bhandari","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Vijay","family":"Laxmi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Manoj","family":"Gaur","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mauro","family":"Conti","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2015,12,20]]},"reference":[{"key":"20_CR1","unstructured":"Android tools: ADB, emulator, AVD manager, android, mksdcard, monkey, logcat. http:\/\/developer.android.com\/tools\/help"},{"key":"20_CR2","unstructured":"Andrubis: a tool for analyzing unknown android applications. http:\/\/anubis.iseclab.org\/ (2014). Accessed July 2014"},{"key":"20_CR3","unstructured":"F-secure malware threat report 2012 q4. http:\/\/www.f-secure.com\/static\/doc\/labs_global\/Research\/Mobile%20Threat%20Report%20Q4%202012.pdf (2014). Accessed November 2014"},{"key":"20_CR4","unstructured":"F-secure malware threat report 2013 q3. http:\/\/www.f-secure.com\/static\/doc\/labs_global\/Research\/Mobile_Threat_Report_Q3_2013.pdf (2014). Accessed July 2014"},{"key":"20_CR5","unstructured":"F-secure malware threat report 2014 q1. http:\/\/www.f-secure.com\/static\/doc\/labs_global\/Research\/Mobile_Threat_Report_Q1_2014_print.pdf (2014). Accessed June 2014"},{"key":"20_CR6","unstructured":"First Sms Trojan for Android. http:\/\/www.securelist.com\/en\/blog\/2254\/First_SMS_Trojan_for_Android (2014). Accessed 2013"},{"key":"20_CR7","unstructured":"Minimum redundancy feature selection-wiki. https:\/\/en.wikipedia.org\/wiki\/Minimum_redundancy_feature_selection (2014). Accessed August 2014"},{"key":"20_CR8","unstructured":"Tcpdump\/libcap public repository. http:\/\/www.tcpdump.org\/ (2014). Accessed July 2014"},{"key":"20_CR9","unstructured":"Android Malware Genome Project. http:\/\/www.malgenomeproject.org\/ (2014). Accessed 11 February 2014"},{"key":"20_CR10","unstructured":"VirusTotal. https:\/\/www.virustotal.com\/ (2014). Accessed 11 February 2014"},{"key":"20_CR11","unstructured":"APKTool. Reverse Engineering with ApkTool. https:\/\/code.google.com\/android\/apk-tool (2012. Accessed 20 March 2012"},{"key":"20_CR12","unstructured":"BakSmali. Reverse Engineering with Smali\/Baksmali. https:\/\/code.google.com\/smali (2014). Accessed 20 March 2014"},{"key":"20_CR13","unstructured":"BlackHat. Reverse Engineering with Androguard. https:\/\/code.google.com\/androguard (2013). Accessed 29 March 2013"},{"key":"20_CR14","doi-asserted-by":"crossref","unstructured":"Bl\u00e4sing, T., Batyuk, L., Schmidt, A.-D., \u00c7amtepe, S.A., Albayrak, S.: An android application sandbox system for suspicious software detection. In: MALWARE, pp. 55\u201362 (2010)","DOI":"10.1109\/MALWARE.2010.5665792"},{"issue":"1","key":"20_CR15","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1023\/A:1010933404324","volume":"45","author":"L Breiman","year":"2001","unstructured":"Breiman, L.: Random forests. Mach. Learn. 45(1), 5\u201332 (2001)","journal-title":"Mach. Learn."},{"key":"20_CR16","doi-asserted-by":"crossref","unstructured":"Burguera, I., Zurutuza, U., Nadjm-Tehrani, S.: Crowdroid: behavior-based malware detection system for android. In: Proceedings of the 1st ACM Workshop on Security and Privacy in Smartphones and Mobile Devices, SPSM\u201911, pp. 15\u201326, New York. ACM (2011)","DOI":"10.1145\/2046614.2046619"},{"key":"20_CR17","doi-asserted-by":"crossref","unstructured":"Conti, M., Dragoni, N., Gottardo, S.: Mithys: mind the hand you shake - protecting mobile devices from SSL usage vulnerabilities. CoRR, abs\/1306.6729 (2013)","DOI":"10.1007\/978-3-642-41098-7_5"},{"key":"20_CR18","doi-asserted-by":"crossref","unstructured":"Cousot, P., Cousot, R.: Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In: Proceedings of the 4th ACM SIGACT-SIGPLAN Symposium on Principles of Programming Languages, pp. 238\u2013252. ACM (1977)","DOI":"10.1145\/512950.512973"},{"key":"20_CR19","unstructured":"Desnos, A., Lantz, P.: Droidbox: an android application sandbox for dynamic analysis (2011)"},{"key":"20_CR20","doi-asserted-by":"crossref","unstructured":"Faruki, P., Bharmal, A., Laxmi, V., Ganmoor, V., Gaur, M., Conti, M., Rajarajan, M.: Android security: a survey of issues, malware penetration, and defenses. Commun. Surv. Tutor. IEEE 17(2), 998\u20131022, Secondquarter (2015)","DOI":"10.1109\/COMST.2014.2386139"},{"key":"20_CR21","doi-asserted-by":"crossref","unstructured":"Faruki, P., Bharmal, A.,\u00a0Laxmi, V., Gaur, M.S.,\u00a0Conti, M.,\u00a0Rajarajan, M.: Evaluation of android anti-malware techniques against dalvik bytecode obfuscation. In: 13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014, Beijing, China, 24\u201326 September 2014, pp. 414\u2013421 (2014)","DOI":"10.1109\/TrustCom.2014.54"},{"key":"20_CR22","doi-asserted-by":"crossref","unstructured":"Faruki, P.,\u00a0Ganmoor, V.,\u00a0Laxmi, V., Gaur, M.S.,\u00a0Bharmal, A.: Androsimilar: robust statistical feature signature for android malware detection. In: Proceedings of the 6th International Conference on Security of Information and Networks, SIN\u201913, pp. 152\u2013159, New York. ACM (2013)","DOI":"10.1145\/2523514.2523539"},{"key":"20_CR23","unstructured":"Faruki, P.,\u00a0Ganmoor, V.,\u00a0Vijay, L.,\u00a0Gaur, M.,\u00a0Conti, M.: Android platform invariant sandbox for analyzing malware and resource hogger apps. In: Proceedings of the 10th IEEE International Conference on Security and Privacy in Communication Networks (SecureComm 2014), Beijing China, 26\u201328 September 2014. Securecomm (2014)"},{"key":"20_CR24","doi-asserted-by":"crossref","unstructured":"Faruki, P.,\u00a0Laxmi, V.,\u00a0Bharmal, A.,\u00a0Gaur, M.,\u00a0Ganmoor, V.: Androsimilar: robust signature for detecting variants of android malware. J. Inf. Secur. Appl. (2014)","DOI":"10.1145\/2523514.2523539"},{"key":"20_CR25","doi-asserted-by":"crossref","unstructured":"Felt, A.P.,\u00a0Chin, E.,\u00a0Hanna, S.,\u00a0Song, D.,\u00a0Wagner, D.: Android permissions demystified. In : Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS\u201911, pp. 627\u2013638, New York. ACM (2011)","DOI":"10.1145\/2046707.2046779"},{"issue":"6","key":"20_CR26","doi-asserted-by":"publisher","first-page":"1027","DOI":"10.1109\/TIFS.2013.2259818","volume":"8","author":"E Fernandes","year":"2013","unstructured":"Fernandes, E., Crispo, B., Conti, M.: FM 99.9, radio virus: exploiting FM radio broadcasts for malware deployment. IEEE Trans. Inf. Forensics Secur. 8(6), 1027\u20131037 (2013)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"20_CR27","unstructured":"Fritz, C., Arzt, S., Rasthofer, S., Bodden, E., Bartel, A., Klein, J., le Traon, Y., Octeau, D., McDaniel, P.: Highly precise taint analysis for android applications. Technical Report EC SPRIDE, TU Darmstadt (2013)"},{"key":"20_CR28","doi-asserted-by":"crossref","unstructured":"Grace, M.C.,\u00a0Zhou, W.,\u00a0Jiang, X., Sadeghi, A.-R.: Unsafe exposure analysis of mobile in-app advertisements. In: Proceedings of the Fifth ACM Conference on Security and Privacy in Wireless and Mobile Networks, WISEC\u201912, pp. 101\u2013112, New York. ACM (2012)","DOI":"10.1145\/2185448.2185464"},{"key":"20_CR29","unstructured":"Grace, M.C., Zhou, Y., Wang, Z., Jiang, X.: Systematic detection of capability leaks in stock android smartphones. In: NDSS. The Internet Society (2012)"},{"key":"20_CR30","doi-asserted-by":"crossref","unstructured":"Kelley, P.G.,\u00a0Consolvo, S., Cranor, L.F.,\u00a0Jung, J., Sadeh, N.M., Wetherall, D.: A conundrum of permissions: installing applications on an android smartphone. In:\u00a0Blythe, J.,\u00a0Dietrich, S., Camp, L.J. (eds.) Financial Cryptography Workshops, Lecture Notes in Computer Science, vol. 7398, pp. 68\u201379. Springer (2012)","DOI":"10.1007\/978-3-642-34638-5_6"},{"key":"20_CR31","doi-asserted-by":"crossref","unstructured":"Kildall, G.A.: A unified approach to global program optimization. In: Proceedings of the 1st annual ACM SIGACT-SIGPLAN symposium on Principles of programming languages, pp. 194\u2013206. ACM (1973)","DOI":"10.1145\/512927.512945"},{"key":"20_CR32","unstructured":"Kim, J.,\u00a0Yoon, Y.,\u00a0Yi, K.,\u00a0Shin, J.,\u00a0Center, S.: ScanDal: static analyzer for detecting privacy leaks in android applications. In: Proceedings of the Workshop on Mobile Security Technologies (MoST), in Conjunction with the IEEE Symposium on Security and Privacy (2012)"},{"key":"20_CR33","unstructured":"Lindorfer, M.: Andrubis: a tool for analyzing unknown android applications. http:\/\/blog.iseclab.org\/2012\/06\/04\/andrubis-a-tool-for-analyzing-unknown-android-applications-2\/ (2012)"},{"key":"20_CR34","doi-asserted-by":"crossref","unstructured":"Lindorfer, M., Neugschwandtner, M., Weichselbaum, L., Fratantonio, Y., van der Veen, V.,\u00a0Platzer, C.: Andrubis\u20141,000,000 apps later: a view on current android malware behaviors. In: Proceedings of the the 3rd International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security (BADGERS) (2014)","DOI":"10.1109\/BADGERS.2014.7"},{"key":"20_CR35","unstructured":"MSWG. Department of computer science and engineering, malaviya national institute of technology, Jaipur. https:\/\/www.droidanalyst.org (2014). Accessed July 2014"},{"key":"20_CR36","unstructured":"Mulliner, C.: Dalvik dynamic instrumentation. http:\/\/www.mulliner.org\/android\/feed\/mulliner_dbi_hitb_kul2013.pdf (2013). Accessed October 2013"},{"key":"20_CR37","unstructured":"Neuner, S., Van der Veen, V.,\u00a0Lindorfer, M.,\u00a0Huber, M.,\u00a0Merzdovnik, G.,\u00a0Mulazzani, M.,\u00a0Weippl, E.: Enter sandbox: android sandbox comparison. In: Proceedings of the IEEE Mobile Security Technologies Workshop (MoST), vol. 5. IEEE (2014)"},{"issue":"8","key":"20_CR38","doi-asserted-by":"publisher","first-page":"1226","DOI":"10.1109\/TPAMI.2005.159","volume":"27","author":"H Peng","year":"2005","unstructured":"Peng, H., Long, F., Ding, C.: Feature selection based on mutual information criteria of max-dependency, max-relevance, and min-redundancy. IEEE Trans. Pattern Anal. Mach. Intell. 27(8), 1226\u20131238 (2005)","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"20_CR39","doi-asserted-by":"crossref","unstructured":"Petsas, T.,\u00a0Voyatzis, G.,\u00a0Athanasopoulos, E.,\u00a0Polychronakis, M.,\u00a0Ioannidis, S.: Rage against the virtual machine: hindering dynamic analysis of android malware. In: Proceedings of the Seventh European Workshop on System Security, p.\u00a05. ACM (2014)","DOI":"10.1145\/2592791.2592796"},{"key":"20_CR40","unstructured":"Play, G.: Official Android Market. https:\/\/market.android.com\/ (2013). Accessed 17 June 2013"},{"key":"20_CR41","unstructured":"Rasthofer, S., Arzt, S., Miltenberger, M., Bodden, E.: Harvesting runtime data in android applications for identifying malware and enhancing code analysis. Technical Report TUD-CS-2015-0031, EC SPRIDE, February (2015)"},{"key":"20_CR42","unstructured":"Reina, A.,\u00a0Fattori, A.,\u00a0Cavallaro, L.: A system call-centric analysis and stimulation technique to automatically reconstruct android malware behaviors. In: Proceedings of the 6th European Workshop on System Security (EUROSEC 2013), Prague, Czech Republic (2013)"},{"issue":"8","key":"20_CR43","doi-asserted-by":"crossref","first-page":"1294","DOI":"10.1109\/TIFS.2013.2267798","volume":"8","author":"Bruno P. S. Rocha","year":"2013","unstructured":"Rocha, B.P.S.,\u00a0Conti, M.,\u00a0Etalle, S.,\u00a0Crispo, B.: Hybrid static-runtime information flow and declassification enforcement. IEEE Trans. Inf. Forensics Secur. 99(8) (2013)","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"20_CR44","doi-asserted-by":"crossref","unstructured":"Roussev, V.: Building a better similarity trap with statistically improbable features. In: 42nd Hawaii International Conference on System Sciences, 2009. HICSS\u201909, pp. 1\u201310. IEEE (2009)","DOI":"10.1109\/HICSS.2009.97"},{"key":"20_CR45","doi-asserted-by":"publisher","first-page":"S34","DOI":"10.1016\/j.diin.2011.05.005","volume":"8","author":"V Roussev","year":"2011","unstructured":"Roussev, V.: An evaluation of forensic similarity hashes. Dig. Investig. 8, S34\u2013S41 (2011). Aug","journal-title":"Dig. Investig."},{"key":"20_CR46","doi-asserted-by":"crossref","unstructured":"Roussev, V.: Data fingerprinting with similarity hashes. Adv. Dig. Forensics (2011)","DOI":"10.1007\/978-3-642-15506-2_15"},{"key":"20_CR47","doi-asserted-by":"crossref","unstructured":"Sanz, B.,\u00a0Santos, I.,\u00a0Laorden, C.,\u00a0Ugarte-Pedrero, X., Bringas, P.G.,\u00a0\u00c1lvarez, G.: Puma: permission usage to detect malware in android. In: International Joint Conference CISIS12-ICEUTE\u2019 12-SOCO\u201912 Special Sessions, pp. 289\u2013298. Springer (2013)","DOI":"10.1007\/978-3-642-33018-6_30"},{"key":"20_CR48","unstructured":"Spreitzenbarth, M.,\u00a0Freiling, F.: Android Malware on the Rise. Technical report (2012)"},{"key":"20_CR49","doi-asserted-by":"crossref","unstructured":"Spreitzenbarth, M.,\u00a0Freiling, F.,\u00a0Echtler, F.,\u00a0Schreck, T.,\u00a0Hoffmann, J.: Mobile-sandbox: having a deeper look into android applications. In: Proceedings of the 28th Annual ACM Symposium on Applied Computing, SAC\u201913, pp. 1808\u20131815, New York. ACM (2013)","DOI":"10.1145\/2480362.2480701"},{"key":"20_CR50","doi-asserted-by":"crossref","unstructured":"Vidas, T.,\u00a0Christin, N.: Evading android runtime analysis via sandbox detection. In: Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS\u201914, pp. 447\u2013458, New York. ACM (2014)","DOI":"10.1145\/2590296.2590325"},{"key":"20_CR51","unstructured":"Weichselbaum, L.,\u00a0Neugschwandtner, M.,\u00a0Lindorfer, M.,\u00a0Fratantonio, Y.,\u00a0van der Veen, V.,\u00a0Platzer, C.: Andrubis: Android Malware Under The Magnifying Glass. Technical Report TR-ISECLAB-0414-001, Vienna University of Technology (2014)"},{"key":"20_CR52","unstructured":"William, E., Peter, G., Byunggon, C., Landon, C.: TaintDroid: an information flow tracking system for realtime privacy monitoring on smartphones. In: USENIX Symposium on Operating Systems Design and Implementation, USENIX (2011)"},{"key":"20_CR53","unstructured":"Yan, L.K.,\u00a0Yin, H.: Droidscope: seamlessly reconstructing the OS and dalvik semantic views for dynamic android malware analysis. In: Proceedings of the 21st USENIX Security Symposium (2012)"},{"key":"20_CR54","doi-asserted-by":"crossref","unstructured":"Zheng, C.,\u00a0Zhu, S.,\u00a0Dai, S.,\u00a0Gu, G.,\u00a0Gong, X.,\u00a0Han, X.,\u00a0Zou, W.: Smartdroid: an automatic system for revealing UI-based trigger conditions in android applications. In: Proceedings of the Second ACM Workshop on Security and Privacy in Smartphones and Mobile Devices, SPSM\u201912, pp. 93\u2013104, New York. ACM (2012)","DOI":"10.1145\/2381934.2381950"},{"key":"20_CR55","doi-asserted-by":"crossref","unstructured":"Zheng, M., Lee, P.P.C., Lui, J.C.S.: ADAM: an automatic and extensible platform to stress test android anti-virus systems. In: DIMVA, pp. 82\u2013101 (2012)","DOI":"10.1007\/978-3-642-37300-8_5"},{"key":"20_CR56","doi-asserted-by":"crossref","unstructured":"Zhou, Y.,\u00a0Jiang, X.: Dissecting android malware: characterization and evolution. In: Proceedings of the 33rd IEEE Symposium on Security and Privacy, Oakland 2012. IEEE (2012)","DOI":"10.1109\/SP.2012.16"},{"key":"20_CR57","unstructured":"Zhou, Y., Wang, Z., Zhou, W., Jiang, X.: Hey, you, get off of my market: Detecting malicious apps in official and alternative android markets. In: NDSS. The Internet Society (2012)"}],"container-title":["Studies in Computational Intelligence","Recent Advances in Computational Intelligence in Defense and Security"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-26450-9_20","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,5,31]],"date-time":"2025-05-31T21:33:23Z","timestamp":1748727203000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-26450-9_20"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,12,20]]},"ISBN":["9783319264486","9783319264509"],"references-count":57,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-26450-9_20","relation":{},"ISSN":["1860-949X","1860-9503"],"issn-type":[{"value":"1860-949X","type":"print"},{"value":"1860-9503","type":"electronic"}],"subject":[],"published":{"date-parts":[[2015,12,20]]}}}