# Advanced Financial Fraud Malware Detection Method
## 2 Related Work
### Static Analysis-Based Malware Detection  
Numerous researchers have explored using static analysis and feature-based methods for detecting Android malware. Table 1 presents a comparison of these studies. In [21], the authors examined Android applications that detect hidden patterns in highly sensitive malware. An automated malware detection system, MalPat, was introduced and tested on a dataset containing 3185 benign apps and 15,336 malware samples obtained from Google Play Store [22], VirusShare [23], and Contagio [24]. MalPat achieved a remarkable F1-score of 98.24%. In [25], an ML approach utilizing logistic regression on permissions and API features was used to detect Android malware. The model was evaluated using two datasets obtained from RPGAurd [26] and Google Play: a full-feature dataset and a reduced-feature dataset containing 131 features. The model achieved accuracies of 97.25% and 95.87% with full- and reduced-feature datasets, respectively. In [27], the authors proposed DeepClassifyDroid, a deep learning-based system for Android malware detection. The system employs a three-step process: feature extraction, feature embedding, and detection using a convolutional neural network (CNN) on datasets obtained from Drebin [28] and Chinese app markets. Initially, it performs a comprehensive static analysis and generates five distinct feature sets. Finally, DeepClassifyDroid uses a CNN to detect malware. It outperformed most conventional ML methods, achieving a 97.4% detection rate without false alarms. Furthermore, it was 10 times faster than linear support vector machine (SVM) models and 80 times faster than k-nearest neighbor (KNN) models. In [29], the performance of the KNN, a simple yet effective ML classifier, was evaluated by examining various distance measures and hyperparameters. Specifically, the study involved extensive experiments on the Drebin [28] dataset and comparisons of multiple well-known distance metrics. The findings revealed that selecting appropriate distance measures  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  
significantly affected classification accuracy. The authors argued that the commonly used Euclidean distance is not optimal for mobile malware detection, and alternative metrics, such as Hamming and CityBlock distances, can improve the classification performance. In [30], a malware prevention system using an \"end-to-end deep-learning architecture\" was proposed. The system detects Android malware and assigns attributes based on the opcodes extracted from the malware. The authors of the study demonstrated that a bidirectional long short-term memory (BiLSTM) neural network outperformed state-of-the-art models in detecting the static behavior of Android malware without using the features developed by other models. Their model demonstrated exceptional performance, achieving an accuracy of 99.90% and an F1-score of 99.60% on a large dataset of more than 1.8 million Android apps obtained from the Android malware dataset (AMD) [31], Drebin [28], and VirusShare [23]. In [32], DANdroid, an Android malware detection model, leveraged a discriminative adversarial network (DAN). The contributions of the study were threefold: (1) the proposed method can effectively differentiate adversarial learning outcomes from malware feature representations; (2) it employs a Multi-view deep learning architecture with three feature sets (raw opcodes, permissions, and API calls) to enhance resistance to obfuscation; and (3) the approach demonstrates the ability to generalize to future obfuscation techniques that were not present during model training. The model attained an average F1-score of 97.3% when evaluated using the Drebin [28] dataset. In [33], the authors proposed a method that extracts the most significant features of Android apps using static analysis supplemented by two newly introduced features. These features were subsequently processed using a functional API-based deep-learning model.