High-Accuracy Android Ransomware Detection Using SMALI Code-Based Analysis

Ransomware targeting the Android platform continues to pose a serious threat to users and organizations, with increasing sophistication and widespread impact. This paper introduces a high-accuracy detection framework that leverages static analysis of SMALI code—a low-level representation generated during APK decompilation—to identify Android ransomware. Unlike approaches that rely on Java-level reconstruction or dynamic behavior, our method extracts meaningful features such as permission usage, API calls, cryptographic operations, and component structure directly from SMALI and manifest files. The framework constructs a structured dataset from these features and applies various machine learning classifiers to distinguish ransomware from benign applications. Experiments conducted on two publicly available datasets, including AMD and CI-CAndMal2017, demonstrate the framework’s effectiveness. The Random Forest classifier achieved a peak accuracy of 98.89%, with the ensemble and model also performing competitively. The results highlight the promise of SMALI-based static analysis for efficient, scalable, and interpretable ransomware detection.