Android Malware Detection using LSTM with Smali Codes

Android Malware Detection using LSTM with Smali Codes | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Android Malware Detection using LSTM with Smali Codes Abhishek Anand, Jyoti Prakash Singh, Rida Sohail Khan, Anjali Kumari, and 1 more This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-3165300/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract With the widespread adoption of smartphones and the rapid growth of the mobile Internet, the Android platform has become highly popular. However, its open-source nature has also made it susceptible to rampant malware attacks. In light of this, this research paper proposes a malware detection system based on Smali-LSTM to enhance the efficiency of malware detection on the Android platform. The detection system employs a static analysis approach to extract Smali files from applications. These extracted Smali files undergo a series of preprocessing steps to extract relevant features. To ensure compatibility with the LSTM model, the preprocessed Smali files are fragmented into smaller pieces. The paper explores and tests fragments of various sizes to identify the optimal configuration that yields the best results. The findings of the study demonstrate that the proposed Smali-LSTM model outperforms existing works that utilize the same dataset and LSTM model. The achieved results showcase an accuracy of 96.58% and an impressive precision of 100%. These outcomes validate the effectiveness and superiority of the proposed model in accurately detecting malware in Android applications. Static malware Analysis LSTM network Smali codes Android Permissions Reverse engineering Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-3165300","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":218219882,"identity":"07870ba8-4f0d-428c-8d44-23813342bb4e","order_by":0,"name":"Abhishek Anand","email":"","orcid":"","institution":"National Institute of Technology Patna","correspondingAuthor":false,"submittingAuthor":false,"prefix":"","firstName":"Abhishek","middleName":"","lastName":"Anand","suffix":""},{"id":218219883,"identity":"e595504e-a963-4d15-892d-ba7c9e90bdc1","order_by":1,"name":"Jyoti Prakash Singh","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAsklEQVRIiWNgGAWjYBACxgYGxgcMBlBeApFamA0YDAxI0AIEbBIMcGuIAcyz259VFxT8yWNgP/yA4eEOYhw254zZ7RkGBsUMPGkGDIlniNEyI4ftNo+BQWIDQw4DQ2IbUVrSnxWDtfC/IVpLghkzWIsE0bbMOWMszWNgXMwm8czgAFFaDGe3P/zM80cuj58/+eHDn0RpmQGhE9iAxAEiNDAwyEtAtRClehSMglEwCkYmAAAZ+i/r750zZQAAAABJRU5ErkJggg==","orcid":"","institution":"National Institute of Technology Patna","correspondingAuthor":true,"submittingAuthor":false,"prefix":"","firstName":"Jyoti","middleName":"Prakash","lastName":"Singh","suffix":""},{"id":218219884,"identity":"075a9775-13a7-4baa-9a0b-5d3c4b3ff326","order_by":2,"name":"Rida Sohail Khan","email":"","orcid":"","institution":"National Institute of Technology Patna","correspondingAuthor":false,"submittingAuthor":false,"prefix":"","firstName":"Rida","middleName":"Sohail","lastName":"Khan","suffix":""},{"id":218219885,"identity":"c6264d68-d9ba-462a-9467-b193f779868e","order_by":3,"name":"Anjali Kumari","email":"","orcid":"","institution":"National Institute of Technology Patna","correspondingAuthor":false,"submittingAuthor":false,"prefix":"","firstName":"Anjali","middleName":"","lastName":"Kumari","suffix":""},{"id":218219886,"identity":"5bb91582-ed75-40d5-81aa-c276ac6c0802","order_by":4,"name":"Divya Mishra","email":"","orcid":"","institution":"National Institute of Technology Patna","correspondingAuthor":false,"submittingAuthor":false,"prefix":"","firstName":"Divya","middleName":"","lastName":"Mishra","suffix":""}],"badges":[],"createdAt":"2023-07-13 01:59:12","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-3165300/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-3165300/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":42314126,"identity":"ecfb2e72-6e63-4d5f-929a-bfd908f14742","added_by":"auto","created_at":"2023-08-29 15:07:32","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":708754,"visible":true,"origin":"","legend":"","description":"","filename":"SmaliIJIS.pdf","url":"https://assets-eu.researchsquare.com/files/rs-3165300/v1_covered_43d2b976-60f5-4e14-87e6-169c34673f7e.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Android Malware Detection using LSTM with Smali Codes","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Static malware Analysis, LSTM network, Smali codes, Android Permissions, Reverse engineering","lastPublishedDoi":"10.21203/rs.3.rs-3165300/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-3165300/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"With the widespread adoption of smartphones and the rapid growth of the mobile Internet, the Android platform has become highly popular. However, its open-source nature has also made it susceptible to rampant malware attacks. In light of this, this research paper proposes a malware detection system based on Smali-LSTM to enhance the efficiency of malware detection on the Android platform. The detection system employs a static analysis approach to extract Smali files from applications. These extracted Smali files undergo a series of preprocessing steps to extract relevant features. To ensure compatibility with the LSTM model, the preprocessed Smali files are fragmented into smaller pieces. The paper explores and tests fragments of various sizes to identify the optimal configuration that yields the best results. The findings of the study demonstrate that the proposed Smali-LSTM model outperforms existing works that utilize the same dataset and LSTM model. The achieved results showcase an accuracy of 96.58\\% and an impressive precision of 100\\%. These outcomes validate the effectiveness and superiority of the proposed model in accurately detecting malware in Android applications.","manuscriptTitle":"Android Malware Detection using LSTM with Smali Codes","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2023-07-17 18:10:58","doi":"10.21203/rs.3.rs-3165300/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"5fc23a3c-1369-4154-8029-f9359e6a926b","owner":[],"postedDate":"July 17th, 2023","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2023-08-29T14:59:23+00:00","versionOfRecord":[],"versionCreatedAt":"2023-07-17 18:10:58","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-3165300","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-3165300","identity":"rs-3165300","version":["v1"]},"buildId":"afDZ1USd8LLqUjqjB8QhT","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}