Abstract: With the improvement of Android malware’s resistance of being detected,traditional static analysis has faced some problems,for example,signature analysis has a high analysis speed,but it suffers repackaging and code confusion problems.Data flow analysis is preferred for its high accuracy,but it is criticized by high resources costs.To deal with the above problems,a new static analysis system was proposed by combining an improved multi-signature analysis and data flow mining method to find a balance point between the accuracy and the efficiency,in which not only the multi-signature analysis is improved by using the signatures of classes and the method,but also the frequent data flow patterns is mined in malware to avoid manual detection.The result shows the system has better capability in solving the repackaging or code confusion problem and the whole detection accuracy approaches 88%.

Key words: Static analysis,Android malware,Signature detection,Data flow pattern mining