Detection of Dynamic Code Loading in Android

Over the past decade, mobile phone usage has surged, with Android dominating the smartphone market. While its open ecosystem facilitates app development, it also makes Android devices a major target for malware attacks. Despite Google Play Protect scanning applications for malware, malicious apps that steal personal and financial data still infiltrate the Play Store. Play Protect struggles to detect advanced techniques like dynamic code loading (DCL) which enables malware to inject harmful code via updates, runtime downloads, or pre-packaged files. Recent research has revealed gaps in Google's policies that enable this behavior, making it a significant threat to Android security. However, previous works do not address this inability to detect DCL behavior or fail to create lightweight models suitable for resource-constrained mobile devices. This work aims to overcome these limitations by focusing on DCL behavior detection in Android malware while ensuring the model remains lightweight. The detection of DCL behavior is achieved by combining manifest-based and code-based features, which are characteristic of Android malware with DCL behavior. Through testing various combinations of features, we identified an optimal feature set of 32 features, which achieved comparable performance to the full feature set with an F1-score of 96 %. This allowed us to reduce the model size by selecting a minimal feature set, minimizing resource usage while maintaining high predictive performance.