# Evaluation of Survivability of the Automatically Obfuscated Android Malware
## 1 Introduction
### Background  
#### 1.1.1 Android Platform  
Android supports the Java language and enables developers to build an application using the available Java libraries. The Android architecture consists of the following five layers: application, application framework, libraries and Dalvik virtual machines, Android runtime, and Linux kernel [6]. The Linux kernel handles the functionalities related to storage, power, application and device drivers, network, memory, and process management. The application developer uses the Linux kernel to perform various tasks, ranging from process management to security. While developing an Android application, developers make use of these services to perform the intended activities [7]. The layer that interacts with the end user is an Application, for example, Browser, Music player, Photo album, etc. The security and privacy concerns related to the developed application must be overseen by the application developer while other components of the architecture are used to enforce security settings. Structure of the Android application file is presented in Figure 1[8]. For example, the androidmanifest.xml file defines the permissions that can be used by an application. This file will be explored in detail in the analysis performed in this research.  
Applications running on the Android platform can call or use an element of other installed or running applications. This function can be achieved by essential components such as activity, services broadcast receivers, and content providers [9]. The subclass for each activity is written, and each activity is inherited from the activity class, making it  
Figure 1: APK file structure.  
the base class. Services are also considered the main component of any application, and they run in the background while an application is in use. The components of the outlined architecture form the Android attack surface.  
An attack surface is a primary attribute used to classify if a specific target is vulnerable to attack based on risk. An attack vector applies to the way an intruder targets a device. In other words, a vulnerable code can be considered an attack surface. Unlike an attack vector, an attack surface does not depend on the attacker's actions or require a vulnerability to exist; instead, it describes the places in the code where vulnerabilities may be present. Additionally, a remote attack surface is one of the most common attack methodologies used by attackers to gain local or root access to the Android terminal [10].  
An example of a local attack on the platform can include changes to the permissions specified in the androidmanifest.xml file required by the Android application. APK tempering is a vulnerability that, if exploited, can be mitigated by adding an application code-signing mechanism [11]. The Android OS allows developers to sign their applications using a certificate provided by the company that developed the application. After an application is signed, the certificate is used to identify the application, and during communication between the application and the other applications, trust between the two is established.