# PACER: Platform for Android Malware Classification, Performance Evaluation and Threat Reporting +
## 1 Introduction  
Malware binary is a compiled \"set of instructions\" or a \"computer program\" written _intentionally_ to perform malicious activities that range from simple pop-up display to unauthorized access of the device [1]. In last two decades, malicious software has been targeting almost all kinds of computing platforms. Over a decade ago, the Android platform gained the majority market share of smartphone operating systems (OS) (see Figure 1--For 2020 only January data is used while for other years an average of 12 months data is used. )and has become the de-facto OS for smartphones ([[https://gs.statcounter.com/os-market-share/mobile/worldwide/2015](https://gs.statcounter.com/os-market-share/mobile/worldwide/2015)]([https://gs.statcounter.com/os-market-share/mobile/worldwide/2015](https://gs.statcounter.com/os-market-share/mobile/worldwide/2015))). This popularity has attracted attackers and malware writers alike and resulted in exponential growth in _Android malware_ (malware specially written for Android OS as the target is called Android malware). Figure 2 depicts Android malware growth from 2012-2019. Recent security threat reports from McAfee ([[https://www.mcafee.com/enterprise/en-us/assets/reports/rp-mobile-threat-report-2019.pdf](https://www.mcafee.com/enterprise/en-us/assets/reports/rp-mobile-threat-report-2019.pdf)]([https://www.mcafee.com/enterprise/en-us/assets/reports/rp-mobile-threat-report-2019.pdf](https://www.mcafee.com/enterprise/en-us/assets/reports/rp-mobile-threat-report-2019.pdf))) and Quickheal (https://www. quickheal.co.in/documents/threat-report/QH-Annual-Threat-Report-2019.pdf) stated not only a rise in Android malware, but also a significant rise in its complexity and scope, e.g., McAfee's highlighted that the creation of recent mobile malware involves _broader groups_ than an individual attacker who is simply spying, or sending premium SMS from the victim's mobile phone. Typically, malware detection techniques are grouped into two main classes i.e., _signature-based_ and _non-signature-based_[2]. Signature-based detection determines signature, i.e., \"a specially arranged sequence of bytes\" by scanning a program and matching it with known signatures database to decide whether the program is malicious or not. Non-signature-based detection creates the behavioral profile of a program by executing it in a safe environment and measures its deviation from known behaviors to identify whether the program is malicious or benign. The traditional signature-based techniques have limitations of a time gap between sample detection in the wild to signature update of the end-user client, which hinders their capabilities of detecting \"unknown\" and \"zero-day\" malware [3]. These techniques also demand high computational resources that burden the end-user device. To address these limitations and bottlenecks, non-signature-based techniques have been extensively used in recent decades [4]. In addition to the above, smartphones (as well as other smart devices) pose extra challenges for malware detection techniques in terms of low computation, memory, and power availability. These resource limitations make the use of signature-based techniques very challenging for Android device security. The small and touch-sensitive smartphone screen also poses challenges (unnoticed  
Figure 1: Smartphone Market Share 2015–20 [statcounter.com]. Figure 2: Android Malware Growth 2012–19 [AV-test.org]. touch, in which, often, attackers take advantage of the small and touch-sensitive screen and hide a button from the plain sight of end users. Unaware and naive users touch (click) on the hidden button which provides a way to perform many malicious activities by attacker, reporting, etc.) for anti-malware solutions. For example, in a recent work, authors have discussed the human factors (misconfiguration of various features such as permissions, network access etc.)