Abstract: Current static-analysis practice on Android application package (APK) mainly uses the features such as permissions,data flows,API calls,extracted from the manifest file and the code.Such features lack consideration on the APK code organizations and object hierarchy,and thus they may be ineffective in describing and predicting an APK’s application behaviors and maliciousness.This research work tried to design and implement a comprehensive API-usage characterization method for Android APK on different resolutions and hierarchies,namely packages,classes,and functions.A tree structure is used to contain such hierarchical API-usage information,and a comparison algorithm is designed for cross-tree similarity,which provides extra insights in classifying and differentiating Android malware of different types and code families.The variations in API-usage on different code layers imply code functionalities and application behaviors,and thus they can be used to improve current static-analysis based malware detection and signature generation.Realistic malware packet samples of various types and families were used to validate the proposed characterization method,and results were discussed for its strength and future improvement.

Key words: Android,Malware,Static analysis