# Similarity-based Android Malware Detection Using Hamming Distance of Static Binary Features

arXiv: https://arxiv.org/abs/1908.05759 · HTML: https://mlsanity.com/paper/1908.05759/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Aug 2019.

## Built on by (most cited first, 8 of 8)

- [A Natural Language Processing Approach to Malware Classification](https://mlsanity.com/paper/2307.11032/) (2023)
- [AgenticSCR: An Autonomous Agentic Secure Code Review for Immature Vulnerabilities Detection](https://mlsanity.com/paper/2601.19138/) (2026)
- [Towards interpreting ML-based automated malware detection models: a survey](https://mlsanity.com/paper/2101.06232/) (2021)
- [Deep Image: A precious image based deep learning method for online malware detection in IoT Environment](https://mlsanity.com/paper/2204.01690/) (2022)
- [On building machine learning pipelines for Android malware detection: a procedural survey of practices, challenges and opportunities](https://mlsanity.com/paper/2306.07118/) (2023)
- [Collective Intelligence: Decentralized Learning for Android Malware Detection in IoT with Blockchain](https://mlsanity.com/paper/2102.13376/) (2021)
- [Adversarial Patterns: Building Robust Android Malware Classifiers](https://mlsanity.com/paper/2203.02121/) (2022)
- [Self-Supervised Deep Subspace Clustering with Entropy-norm](https://mlsanity.com/paper/2206.04958/) (2022)

## Abstract (arXiv)

In this paper, we develop four malware detection methods using Hamming distance to find similarity between samples which are first nearest neighbors (FNN), all nearest neighbors (ANN), weighted all nearest neighbors (WANN), and k-medoid based nearest neighbors (KMNN). In our proposed methods, we can trigger the alarm if we detect an Android app is malicious. Hence, our solutions help us to avoid the spread of detected malware on a broader scale. We provide a detailed description of the proposed detection methods and related algorithms. We include an extensive analysis to asses the suitability of our proposed similarity-based detection methods. In this way, we perform our experiments on three datasets, including benign and malware Android apps like Drebin, Contagio, and Genome. Thus, to corroborate the actual effectiveness of our classifier, we carry out performance comparisons with some state-of-the-art classification and malware detection algorithms, namely Mixed and Separated solutions, the program dissimilarity measure based on entropy (PDME) and the FalDroid algorithms. We test our experiments in a different type of features: API, intent, and permission features on these three datasets. The results confirm that accuracy rates of proposed algorithms are more than 90% and in some cases (i.e., considering API features) are more than 99%, and are comparable with existing state-of-the-art solutions.