# Evaluation of Survivability of the Automatically Obfuscated Android Malware
## 1 Introduction
### Related Works in Obfuscated Malware Analysis
They used a trace tool for system-calls extraction and extracted 345 Android malicious APKs that belonged to ten Android malware families. In their findings, they discovered that typically malicious applications initiate more system calls than benign apps. The study also identified \"suspicious\" system calls that were actively used by malware. [PERSON] et al. [202] proposed contrastive learning to detect obfuscated malware. They tested the approach on 8000+ malware samples achieving a 99% detection ratio and obfuscation resilience. Unfortunately, similar to [17], the study did not indicate the success of their method of obfuscation in terms of if the obfuscated malware was actually functional after obfuscation. In their work, [PERSON] et al. [21] looked at the ways developers of legitimate applications and developers of malware can protect their products from reverse engineering or detection. They provided a comprehensive taxonomy of obfuscation techniques that have been proposed in the research literature but the practical evaluation of these techniques and their combinations were not in the scope of the review. That leaves open the question of the applicability of various obfuscation techniques in actual complex applications. Even though these techniques do not change the main logic of the application in theory, their automated implementation with existing tools may actually incapicate the applications. All the works reviewed above indicated that obfuscation tools are readily available for application developers and obfuscation techniques indeed significantly reduce the malware detection ratio. Even though some experimental malware detection tools achieve better detection rates they are still not the mainstream solutions used in the industry. Unfortunately, the reviewed research on malware obfuscation did not focus on the question of the intrinsic quality of automated malware obfuscation. In other words, it is not clear if after the automated application of obfuscation techniques advanced applications such as malwares are still functional and harmful. The research project presented in this paper aims to study the impact of obfuscation on the malware functionality and detection ratio. The impact of obfuscation on malware functionality can be studied through the analysis of the installability and runability of the obfuscated software. In other words, such an analysis would detect whether obfuscated malware can be actually installed on an Android platform and if it can be launched without an immediate crash. This is crucial information because automated tools perform \"blind\" obfuscations that may incapatate the malware. This research aims to answer the following questions:  
1. Can feature extraction prove helpful in identifying APKs that have been subjected to obfuscation? 2. What is the most effective obfuscation method out of the ones being implemented? 3. Which obfuscation method produces the most installable and runnable APKs? 4. Which obfuscation method produces the most non-installable and runnable APKs?