# TrojanDetector: A Multi-Layer Hybrid Approach for Trojan Detection in Android Applications
## 1 Introduction  
Mobile malware applications are divided into several categories based on their destructive purposes and behaviours (Trojans, Viruses, Worms, Botnets, Spyware, annoying advertising tools, etc.). Trojans are applications that are seemingly useful and risk-free. These applications secretly perform destructive actions such as stealing users' information, damaging their devices, changing system settings, loading malicious applications, etc. [1]. Android is open-source and extremely popular on mobile platforms and is targeted by over 99% of malware attacks [2]. Nearly half of these malware attacks are multi-functional Trojans capable of stealing users' personal and sensitive data, i.e., contacts, email addresses, and phone numbers. Besides stealing data, they are able to download additional modules from the infected servers being maintained by attackers. Detecting malware, in general, and Trojans, in particular, could be done by performing static or dynamic analysis. Static analysis is performed without executing the program. Examples of the information we can obtain from static analysis include opcode sequences (extracted by disassembling the binary file), control flow graphs, and so on. Such feature sets can be used individually or in combination for malware detection. On the other hand, dynamic analysis requires that we execute the program, often in a virtual environment. Examples of information that can be obtained by dynamic analysis include API calls, system calls, instruction traces, registry changes, memory writes, and so on. Technically, static analysis finds an app's dangerous traits or faulty code parts without executing it. In comparison, the dynamic analysis collects the app's activity data to detectmalicious behaviour during the app's operations [3]. Static analysis has been shown to be somehow accurate and efficient in detecting known malware; however, it has been found less accurate against apps containing camouflage techniques and encrypted code parts. Additionally, they could not detect intrusions in real-time. In contrast, dynamic analysis can detect zero-day threats; however, at the cost of expensive computations because it could involve multiple resources running in parallel. These schemes are also not shown to be highly accurate [3]. Detecting Trojan attacks by considering a single layer, e.g., the application layer where the users use the application or only the package layer where the files of the apps are saved on the Android, is not enough. Trojans can change their pattern by attacking by SMS or emails or by attacking the system directly by getting permission. For instance, an excessive amount of pop-up ads suddenly changes to user's email service and starts sending spam messages to all addresses in the contacts and then automatically unauthorised application installation, which can make it more difficult to detect if all layers (e.g., application, package, and user layer) are not monitored together. Suppose only one layer with a few features considers SMS quantity and email quality. In that case, the detection of Trojan attacks is a problem on the other layers, such as the user layer, network layer, etc. Due to this problem of detecting the Trojan on a single layer, Trojans still have the door to attack the other layers because they constantly change their behaviours and patterns and cause serious damage to user privacy, security, and data loss. Various security solutions have been proposed recently, which apply static or dynamic analysis of the applications [4] and apply security approaches by implementing data security with run-time enforcement. However, these approaches have limitations: firstly, they are layer-specific, tackle a single layer (e.g., application layer or user layer), and require a custom operating system [5]. Secondly, they are applied individually, resulting in lower detection accuracy.