# Web-Based Android Malicious Software Detection and Classification System
## 1 Introduction  
The use of mobile devices has been increasing in the world. Mobile device users can easily perform banking, shopping, web page navigation, gaming, and similar transactions without computers. According to first quarter report of International Data Corporation (IDC) Company of 2017, the global smartphone market has grown 3.4% and Android's market share in the smartphone market has reached up to 85% [1]. According to the G Data H1/2016 report, worldwide use of the Android platform was determined to be 68% in the first half of 2016 [2]. Again, according to this report, 1,723,265 new malicious application examples were identified. Yet again, the amount of new malicious software is increasing, as well as the complexity of the malicious software introduced to prevent the detection of malicious software. Google Play Protect, announced at Google I/O 2017, runs embedded on Play Store and scans the applications before and after their installations [3, 4].  
Android apps have become the target of malicious software developers because the Android platform has a free and open-source operating system, and whenever an application is added on the Google Play Market, the app is not examined in detail [5]. Beginning from version 6.0 Marshmallow, the operating system warns users and demands confirmation when an application requests a dangerous permission at run time. Additionally, unlike previous versions, you have the option to turn off the permissions in the latest version. These features are included on Android 6.0, so users of older Android versions are not able to use these features. Since 38.6% of Android users use Android 5.1 and older as of 2018 (Data collected during a 7-day period ending on 16 April 2018) [6], solutions covering all Android users are needed. It is, therefore, essential to develop systems that detect whether applications on the Google Play Market and other application markets are benign or malicious software. Yet, the resources of mobile devices are inadequate for such a detection system.  
In this study, an Android malware detection system was developed to detect malicious applications through client-server architecture, static analysis and web-scraping methods. All transactions are conducted on the server side in consideration of the limited resource of mobile phones. Hence, there is no load generated on the client side. Virus Total, which is a highly trusted virus/malware scanner tool, was integrated into the developed system and used in the calculation method. The robustness of the developed system was evaluated using 5545 malicious and 1173 benign Android applications. The developed system was compared with existing static analysis methods as a basis for a discussion of its pros and cons.  
In this article, the following topics are discussed in sequence: the related literature is reviewed in the second section; the structure of the developed system and the used tools are shown in the third section; the obtained outcomes of the performance evaluation are shared in the fourth section; the studies to be conducted in the future and the results of the research are given in the last section.