CAED: A Comprehensive Android Emulator Detection Framework With Data Augmentation

Anti-emulation is crucial for Android and IoT security as it helps apps determine whether they are running on a real mobile device or in an emulation environment. This prevents apps from being analyzed, debugged, or reverse-engineered in emulators, ultimately stopping criminals from making illegal profits. Current emulator detection methods cannot balance accuracy, universality, robustness, and compatibility. Their universality is often hindered by limited data diversity and accessibility. To address these issues, we propose the comprehensive Android emulator detection (CAED) framework. The Preprocessing Module of CAED collects and normalizes data from both phones and emulators. We propose the first data augmentation method for emulator detection, emulator detection augmentation generative adversarial network (EDA-GAN), which is tailored to the characteristics of our data and effectively enhances data diversity. The classifier module MFBoost employs an adaptive imputation algorithm and multiple classification and regression trees (CART) for precise classification. Experiments on 324 devices show that CAED improves detection rate by at least 12.5% and up to 44.71% over state-of-the-art (SOTA) methods. The EDA-GAN data augmentation method boosts classifier accuracy, achieving a performance of up to 99.62%. Additionally, CAED’s unique loss function and imputation algorithm enhance the robustness and compatibility of CAED, with a 24% smaller accuracy drop than other methods when features are modified or unavailable. This study presents the CAED framework as an effective solution for protecting apps against real-world security threats in Android and IoT environments.