# Evaluation of Survivability of the Automatically Obfuscated Android Malware
## 2 Materials and Methods
### Static Analysis  
In the static analysis stage, the application is decompiled to obtain the following four features that are used to classify the application: permissions, native-permissions, intent-priority, and sensitive functions [23]. The Android operating system provides a control mechanism by which to restrict application permissions [24] as a security feature but associative functions can be abused if the application wants to execute a specific function without declaring the appropriate permission in the manifest.xml file. Permissions are used to control applications' functions and to manage the resources of the mobile phone. \begin{table}
\begin{tabular}{c c} \hline \hline
**Method** & **Transformations** \\ \hline Reflection & Existing code is examined to find invocations of the main application \\  & method while ignoring the Android framework calls. This method can be \\  & called using the Reflection APIs. \\ \hline AdvancedReflection & Using reflection, dangerous APIs from the Android Framework \\  & are invoked. \\ \hline ArithmeticBranch & Uses the junk code insertion technique. A branch instruction is crafted in \\  & such a way that the branch is never taken, which results in a piece of junk \\  & code composed of arithmetic computations and branch instructions. \\ \hline CallIndirection & \begin{tabular}{c} Adds new methods that invoke the original ones. Modifies the \\ control-flow graph without touching the code semantics. \\ \end{tabular} \\ \hline DebugRemoval & The debug meta-data are removed. \\ \hline GoTo & \begin{tabular}{c} The software will insert a GoTo into the method and a second GoTo after \\ the first GoTo at the end of the method so that the control-flow graph \\ is modified. \\ \end{tabular} \\ \hline MethodOverload & \begin{tabular}{c} This exploits the Java overloading feature to return different methods \\ with the same name but with varying arguments. \\ \end{tabular} \\ \hline Nop & \
\begin{tabular}{c} Random Nop (No Operations) instructions are inserted into every \\ method implementation. \\ \end{tabular} \\ \hline Reorder &
\begin{tabular}{c} The order of blocks changes in this technique. An inverted condition and \\ reordered basic blocks are created when a branch instruction is found \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Non-Trivial Obfuscation Techniques-Code. \begin{table}
\begin{tabular}{c c} \hline \hline
**Obfuscation Strategy** & **Methods** \\ \hline Encryption & \begin{tabular}{c} AssetEncryption, ConstStringEncryption, LibEncryption, \\ ResStringEncryption \\ \end{tabular} \\ \hline Code & \begin{tabular}{c} AdvancedReflection, ArithmeticBranch, CallIndirection, \\ DebugRemoval, Goto, MethodOverload, Nop, Reflection, Reorder \\ \end{tabular} \\ \hline Rename & ClassRename, FieldRename, MethodRename \\ \hline Low & \begin{tabular}{c} ClassRename, AssetEncryption, AdvancedReflection, \\ MethodOverload, Goto \\ \end{tabular} \\ \hline Medium & \
\begin{tabular}{c} ClassRename, FieldRename, ConstStringEncryption, \\ ResStringEncryption, AssetEncryption, AdvancedReflection, \\ MethodOverload, ArithmeticBranch, CallIndirection \\ \end{tabular} \\ \hline High &
\begin{tabular}{c} ClassRename, FieldRename, MethodRename, ConstStringEncryption, \\ ResStringEncryption, AssetEncryption, AssetEncryption, \\ AdvancedReflection, MethodOverload, ArithmeticBranch, CallIndirection, DebugRemoval \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Obfuscation Strategies. Given these relatively mild restrictions, the Android OS can be seen as a relatively open environment and some malware developers may utilize this feature to hide the real purpose of applications or embed malicious functions within normal ones for malicious purposes. Table 6 lists permissions that can be seen as dangerous as they can be misused by application developers to perform functions that are not declared in the application description [24]. For example, the INSTALL_PACKAGES permission may be used by a seemingly benign application to install malware.