# Evaluation of Survivability of the Automatically Obfuscated Android Malware
## 3 Results
### Finding: Application Installation and Runnability  
To check the \"survival\" ratio of applications subjected to obfuscation, they were tested for installability and runnability. To verify the installability of the applications, seven sample sets of applications were prepared. Sample 1 consisted of 14 randomly selected applications and Samples 2 to 7 included 10 randomly selected applications. Samples were relatively small due to the following two factors: (a) manual verification of the results and (b) the need to contain potential errors in installation to a smaller population of applications. For all the samples, the selection included benign and malicious applications. Each sample set was subjected to six of the various obfuscation strategies described earlier. Samples from the Sample 1 set that were obfuscated were first installed in Anbox Application Manager using the automated script. Out of the 14 applications that were randomly selected for every obfuscation method, 12 applications were successfully installed every time. The other two applications could not be installed. However, these 12 applications were not runnable on Anbox. The applications froze Anbox every time they were loaded into the emulator. Additionally, these applications were manually installed in _Android Studio_. All 14 applications were successfully installed and were runnable. From samples 2-7, the obfuscated applications did not successfully install in the Anbox application manager. The reason for this may be the higher API level that Anbox runs on. This reason was identified because the obfuscated applications were also installed on _Android Studio_ with a higher- and a lower-level API machine. The applications were successfully installed on the virtual Android device with a lower API level of 22 and were not installed on the Android device with a higher API level of 24. It is also worthy of note that the original applications were successfully installed in Anbox and Android Studio. It was clear that blind obfuscation may not always work, and potential attackers would need to pay attention to the API level/version when they prepare obfuscated malware. Table 12 provides detailed information on the results of the installability tests for all seven sets of applications. The review of data obtained from the installability analysis shows that the obfuscation strategy \"Code\" produced the highest number of valid applications post obfuscation with 73.71% valid applications. The \"Encryption\" method produced 72.28% valid applications. The \"Rename\" method produced 70.85% valid applications. The \"Low\" method produced 60.85% valid applications. The \"Medium\" method produced 55.14% valid applications, and the \"High\" method produced the lowest number of valid applications by producing just 50.85% valid applications. These results clearly indicate that trivial obfuscation strategies provide better chances for automated obfuscation while the automated application of more sophisticated/polymorphic obfuscation strategies may produce applications that are not actually functional. Figure 3 compares the results obtained from the static and dynamic analyses along with an installability check. It was observed that the application of multiple levels of polymorphic obfuscation bypassed both the static and dynamic detection algorithms and at the same time caused a greater degree of changes in the application semantics resulting in non-functional malware APK. On the other hand, trivial and monomorphic obfuscation produced APKs with a higher detection ratio but maintained the semantics of the APKs. Overall, the Code obfuscation strategy produced the most optimum results with a lower detection ratio and higher installation probability.