# Advanced Financial Fraud Malware Detection Method
## 1 Introduction  
Google Play Store offers over 2.85 million applications (apps) [1]. The number of available apps surpassed one million in July 2013 and reached 2.43 million in the fourth quarter of 2023 [2]. These apps provide users with services, such as online shopping, gaming, finance, health, social networking, location tracking, and navigation. According to a report by the International Data Corporation, 326.1 million mobile phones were shipped in the fourth quarter of 2023 [3], and phones based on open-source Android comprise 70.1% of the smartphone market [4]. The openness and extensive adoption of Android make it a crucial target for malicious attackers [5]. A tremendous amount of Android malware has been created and spread and has been used in various illegal activities, including stealing personal information from devices, damaging systems, and phishing. Moreover, unlike the Play Store, untrustworthy app stores allow users to indiscriminately download apps without safety mechanisms, readily exposing them to risk from attackers. The urgency and importance of malwaredetection have increased, particularly as mobile financial services such as mobile banking and electronic payments have become popular and widespread [6]. New financial fraud malware is often crafted to bypass antiviral software and stealthily infiltrate smartphones. These attacks predominantly focus on Android users, who enjoy considerable freedom in development and application usage. Users who lack awareness of common phishing scams and malware prevention solutions on their phones are the most vulnerable to malware attacks [7]. Financial fraud losses in South Korea, totaling 145.1 billion KRW in 2022, increased by 35.4% to 196.5 billion KRW in 2023, with countless users remaining at risk of financial fraud [8]. [PERSON] et al. [9] identified 22% of the apps on the Google Play Store and 50% of those on App China as malware apps. Mobile malware is constantly evolving with new features designed to evade detection by malware scanners. Android malware applications typically employ three principal techniques to compromise user devices: repair, update, and download [10]. Various malware detection models have been proposed to protect consumers' personal information and ensure economic security. These studies can be broadly divided into three types: static [11], dynamic [12], and hybrid [13] analyses. Static analysis enables malware detection without executing an application. Consequently, mobile devices are unaffected by malicious malware [14]. Static analysis provides a secure approach to malware detection. Conversely, dynamic analysis requires the execution of an application within an isolated environment. Owing to the limitations of the operational environment, a dynamic analysis must be performed at runtime to detect suspicious behaviors. However, as the number of Android apps has increased exponentially, the efficiency of dynamic analysis methods to identify malware has decreased. Finally, hybrid analysis combines static and dynamic methods. We propose a static-analysis-based method to identify financial fraud malware. Specifically, static analysis enables the rapid scanning of large applications by examining code or APK files without executing malicious code. It can also identify malicious behavior patterns through an in-depth analysis of the APK structure, such as permission requests and application programming interface (API) calls, and detect malware using specific code patterns or function calls. Additionally, it offers the benefit of a pre-execution review, which ensures that malware can be detected before it is activated. Finally, static analysis conserves resources because it does not require real-world execution environments, making it ideal for efficiently scanning many apps. Our study focuses on malware types that are highly associated with financial fraud. These include billing fraud, stalkerware, hostile downloaders, phishing, and spyware (Figure 1) [15]. Figure 1: Malware categories.