# TrojanDetector: A Multi-Layer Hybrid Approach for Trojan Detection in Android Applications
## 2 Related Work  
The analysis of intrusion detection on Android devices is a rich field in the literature. Three main approaches, e.g., static, dynamic, and hybrid, as shown in Table 1, are used in the literature to analyse malware detection in Android applications. Examples of static approaches are DroidSieve [12] and MiMalo [13], which analyse the features on the application layer. Similarly, dynamic approaches [10; 14; 15; 16] are also available for feature analysis on the applications layer using machine learning and deep learning. A hybrid analysis approach uses static and dynamic features for detecting malware, which has been found to be more accurate due to the complementary strength of both types of analysis. The hybrid analysis exploits the static and dynamic features to detect malware in specific use cases [17]. A hybrid approach uses the Android application sandbox environment and performs static and dynamic analysis in an offline mode. Both static and dynamic approaches have their limitations, e.g., static analysis is more time-consuming, and dynamic analysis is more resource-consuming for malware detection. [PERSON] et al. [18] presented an engine called DroidDetector and automatically characterised the application as benign or malicious. The DroidDetector has 96.76% accuracy compared to the traditional machine learning (ML) approaches. [PERSON] and [PERSON] [3] used a hybrid approach that considered the advantages and disadvantages of static and dynamic analysis to detect Android malware. They collected the behaviour data of the application dynamically. They used the static method in offline mode for the analysis of malicious and normal patterns of the application from that collected data. They used a powerful malware detection server to improve the processing speed and acceleration of malware detection. [PERSON] et al. [17] presented a static and dynamic analysis framework. They ran a learning classification model on its OmniDroid dataset, which consists of 22,000 samples of malware and benign Android applications. [PERSON] et al. [18] also proposed a hybrid analysis approach and developed a machine learning and deep learning model for detecting malware in the Android operating system. They used the Genome dataset and the Drebin project for static analysis and the CICMalDroiD [11] dataset for dynamic analysis. Then they extracted 261 combined features and applied a hybrid analysis approach. They further used 311 application samples, including 165 benign from the play-store and 146 malicious apps from the VirusShare, and increased the detection rate by about 5%. Another hybrid approach, ShielDriod [19], uses the CICMalDroid dataset and analyses the malware on the application layer. They used random forest (RF) and multilayer perceptron models and achieved 97% accuracy. We proposed a hybrid technique and compared it to the state-of-the-art techniques as baselines. We found that the TrojanDetector did not outperform state-of-the-art peer approaches to malware detection on Android in general, such as DroidSieve [12] and DroidCat [14]. Both DroidSieve and DroidCat achieved higher accuracy than the proposeddetection approach. DroidSieve is an Android malware classifier based on static analysis with an accuracy of 99.82%, whereas DroidCat is based on dynamic analysis with an accuracy of 97%. However, considering the intrinsic limitations of both static and dynamic approaches (refer to Section 1), the results are not comparable to TrojanDetector (with an accuracy of 96.64%) based on combining both approaches and features extracted from multiple layers, unlike DroidSieve and DroidCat. TrojanDetector improves the state-of-the-art by implementing a hybrid analysis approach on three different layers, called the multi-layer hybrid analysis approach. Further, compared to the state-of-the-art approaches, this work considers the most notable features only at various levels of Android phones (called the multi-layer hybrid approach) to detect Trojans. [PERSON] et al. (2020) focused on only a single layer of Android.