"Andromaly": A behavioral malware detection framework for android devices

Asaf Shabtai, Uri Kanonov, Yuval Elovici, Chanan Glezer, Yael Weiss

Research output: Contribution to journalArticlepeer-review

574 Scopus citations


This article presents Andromaly-a framework for detecting malware on Android mobile devices. The proposed framework realizes a Host-based Malware Detection System that continuously monitors various features and events obtained from the mobile device and then applies Machine Learning anomaly detectors to classify the collected data as normal (benign) or abnormal (malicious). Since no malicious applications are yet available for Android, we developed four malicious applications, and evaluated Andromaly's ability to detect new malware based on samples of known malware. We evaluated several combinations of anomaly detection algorithms, feature selection method and the number of top features in order to find the combination that yields the best performance in detecting new malware on Android. Empirical results suggest that the proposed framework is effective in detecting malware on mobile devices in general and on Android in particular.

Original languageEnglish
Pages (from-to)161-190
Number of pages30
JournalJournal of Intelligent Information Systems
Issue number1
StatePublished - Feb 2012
Externally publishedYes


  • Android
  • Machine learning
  • Malware
  • Mobile devices
  • Security


Dive into the research topics of '"Andromaly": A behavioral malware detection framework for android devices'. Together they form a unique fingerprint.

Cite this