# Evaluation of Survivability of the Automatically Obfuscated Android Malware
## 1 Introduction
### Related Works in Obfuscated Malware Analysis  
[PERSON] et al. [16] evaluated the efficiency of anti-malware products for detecting malware subjected to trivial and non-trivial obfuscations. The study proved that 10 out of 10 anti-malware products used for tests failed to detect the applications that had undergone code obfuscation. The outcomes derived from the research on the obfuscation of malware also showed that obfuscating malware can have a disadvantage which states that the malware loses its malicious function, causing no damage to its victim's system. In other words, significant mutations in the virus body may make it less harmful or not harmful at all. Additionally, anti-malware tools such as VirusTotal lack the capability of developing resilience against such obfuscations as they do not always update their signature database after a malicious variant of the application is detected. Nine days elapsed before the anti-malware tools used in their study were able to detect, analyze, and develop signatures, leaving substantial time in which to infect mobile devices. Out of the 10 leading anti-malware providers, only 57% of their signatures provided code-level artifacts. The study revealed that 43% of signature identifications did not focus on code-level artifacts and that component names in the Android manifest were the only way to identify defects. The study also indicated that 90 percent of signatures did not require a static bytecode review since much of the information was contained in the classes--dex file of the application with an Android runtime code [16]. In their study, [PERSON] et al. [17] discovered that an anti-malware product's detection ability depends both on the obfuscation methodology and the tool used for obfuscation. The detection rate by top anti-malware products dropped by about 20% after malware was obfuscated. The same study proved that applying a specific set of transformations, both trivial or non-trivial, along with the use of commercial obfuscation tools, can achieve a high anti-malware evasion rate, a more extended survival period, and less accurate signature detection [18]. [PERSON] et al. [18] also looked at the effectiveness of antivirus engines against obfuscated Android malware. The report looked at five Android malware variants that belonged to ten different malware families before obfuscation, and their detection ratings were used. Then, they were compared with obfuscated Android malware by applying three obfuscation techniques, namely string encryption, renaming, and control flow both individually and in combination. After the individual implementation of obfuscation techniques, their detection ratio decreases significantly, and when a combination of the obfuscation techniques was applied, the likelihood of the detection rate significantly reduced. For example, the research analysis showed that when using a combination of three obfuscation techniques (Control flow, Renaming, String Encryption), an average of only 23.19% samples out of the 50 malware samples (five samples each under ten families) were detected by 60+ analyzers under VirusTotal. Without obfuscation, the average detection rate was much higher: 54.58%. The authors also mentioned that a further step is required for this research study to perform a dynamic analysis of obfuscated Android malware to capture their system calls and compare their results with system calls invoked by non-obfuscated Android malware. Another study by [PERSON] and [PERSON] [19] indicated that the detection of obfuscated malware is insufficient with static malware analysis tools and techniques. System call analysis is a powerful technique for malware that is highly encrypted or obfuscated with other methods. Obfuscated malware uses the same system calls (although with different numbers) and performs the same file and network operations during the runtime. To verify the hypothesis, the study focused more on the behavioral characteristics of malware.