# PACER: Platform for Android Malware Classification, Performance Evaluation and Threat Reporting +
## 2 Background  
The popularity and storage capacity (personal and financial informational) of Android devices have made them a prime target for attackers. There have been many previous works which have proposed solutions to detect and prevent malware attacks on Android devices. Machine Learning (ML)-based solutions are addressing bottlenecks such as the inability to detect \"unknown\" and \"zero-day\" malware and regular signature updates of traditional signature-based detection. In 2012, Google integrated _Bouncer_ ([[http://google.blogspot.com/2012/02/android-and-security.html](http://google.blogspot.com/2012/02/android-and-security.html)]([http://google.blogspot.com/2012/02/android-and-security.html](http://google.blogspot.com/2012/02/android-and-security.html))) into the _Google Play Store_ which scans every application and developer account before allowing them to appear in the store, and then keeps a regular check on in-device apps through _Google Play Protect_ (_[[https://support.google.com/accounts/answer/2812853?hl=en_](https://support.google.com/accounts/answer/2812853?hl=en_)]([https://support.google.com/accounts/answer/2812853?hl=en_](https://support.google.com/accounts/answer/2812853?hl=en_))). This work is based on machine-learning algorithms and scanning devices in real time. Over time, it has been demonstrated that Google's _Bouncer_ is not perfect at detecting malicious Android applications and specially crafted malware can evade detection ([[https://jon.oberheide.org/blog/?p=1004](https://jon.oberheide.org/blog/?p=1004)]([https://jon.oberheide.org/blog/?p=1004](https://jon.oberheide.org/blog/?p=1004))).  
In the literature, ML-based Android detection is either considered to be a _binary-class_ or _multi-class_ classification problem. In the case of binary classification, malware and benign software are considered to be two classes. However, in multi-class classification, Android malware is grouped into various malware families [16; 17; 18; 19; 20]. Currently, the proposed work is focused on binary classification and does not support multi-class classification, which is mostly used for finding malware families i.e., variants of known malware. Based on the type of feature extraction method, the ML-based Android malware detection is grouped into two main categories i.e., static and dynamic detection. Static detection works with features that are extracted through static analysis, and the dynamic detection techniques are based on features that are extracted through dynamic analysis. The Section 2.1 summarizes and presents solutions proposed in the literature related to static and dynamic feature-based detection (Sections 2.1.1 and 2.1.2, respectively). The generation of a report based on the various OS and app activities on Android devices is a key area of research that attempts to fulfill different requirements such as legal requirements, security analysis, and threat intelligence through monitoring, observing, extracting, and analyzing apps to OS interactions and vice versa. Section 2.1.3 provides a brief introduction of the literature related to different types of the reporting system for Android devices.