# Malware Analysis in IoT & Android Systems with Defensive Mechanism
## 8 Conclusions and Future Scope  
The primary objective of this work is to present the current security state of IoT and Android systems. Developers and researchers are developing new technologies to safeguard users and devices from attackers. This work discussed several attacks on various layers of IoT and Android devices, as well as countermeasures offered by researchers. This work tabulated explanations of threats and the solutions to prevent them. Several important findings, including secure hardware architecture design, a two-step malware detection approach, i.e., static followed by a dynamic approach, or hybrid techniques for malware identification, are suggested. A strong suggestion is provided for developers to follow security protocols, proper authentication and authorization, two-step or multi-step verification, and a strong encryption algorithm. Along with these proposed techniques, some additional steps that can provide a more secure environment are:  
1. In order to solve the privacy issue, application developers should restrict permissions, and only essential permissions should be granted. A robust permission system and a standard should be followed.
2. To limit the common vulnerabilities and zero-day exploits, the database, i.e., the Google Play Store, must come with robust permissions, malware detection tools, and clone detection techniques, to protect users from exploitation.
3. Whenever a new application from a third party is installed on an Android device, it must warn the user about the threat and the application must submit to Google for static and dynamic analysis of potential threat identification.
4. Android must design an application where the user can trace the requested IP address, webpages, port request, memory use, and CPU analysis in an accessible way, as is available in Windows OS.
5. In order to comply with the CIA triad, developers must follow the latest SSL/TLS security protocol on every page of the application.  
In order to solve the authentication and authorization issue, users must follow the direction and advice of strong passwords, phishing sites, URLs, and not sharing personal and confidential information, i.e., OTP, Login id, password, etc.
* (7) Applications related to the financial sector must be checked by CERT-in (The Indian Computer Emergency Response Team) and STQC (Standardisation Testing and Quality Certification) impaneled organizations.
* (8) Continuous innovation and research are required to protect against unforeseen threats and vulnerabilities in known and unknown environments.  
Writing--original draft, C.S.Y.; conceptualization, writing--review & editing, J.S.; visualization, validation A.Y.; visualization, resources, specifically visualization/data presentation, H.S.P.; data curation, resources. conceptualization R.K.; funding acquisition, analysis A.A.K.; project administration, supervision, funding acquisition, M.A.H.; funding acquisition, methodology, writing--editing, A.A.; funding acquisition, analysis, writing--review, S.A. All authors have read and agreed to the published version of the manuscript.  
[PERSON] like to thank the Deanship of Scientific Research at Majmaah University for supporting this work under Project No. R-2022-214.  
[PERSON] like to acknowledge the Deanship of Scientific Research at Majmaah University for supporting this work under Project No. R-2022-214.  
The authors declare that they have no conflict of interest.  
This article does not contain any studies with human participants performed by any of the authors.