An Android Malware Detection Method Based on Native Code and LSTM

The ubiquity of mobile Internet has made smartphones an essential component of modern life, yet they remain prime targets for information security threats. Despite a multitude of malware detection systems, skilled developers of malicious software adeptly conceal harmful code within applications, thus eluding standard detection techniques. A significant challenge in Android application reverse engineering is the extraction of critical code from ".so" files, known as native code, which is often viewed as a secure and clandestine strategy in Android development. Addressing this challenge, our research introduces a novel Android malware detection approach that leverages Long Short-Term Memory (LSTM) networks to scrutinize native code opcodes. By decompressing Android Application Packages (APKs) and extracting opcodes from shared libraries, we utilize the tf-idf algorithm for feature selection, facilitating the detection of obscured malicious code in a static analysis context. This methodology, bolstered by LSTM training, constructs a formidable framework for Android malware detection. Our empirical assessments confirm the method's effectiveness and superiority in detecting Android malware.