# Light up that Droid! On the Effectiveness of Static Analysis Features against App Obfuscation for Android Malware Detection

arXiv: https://arxiv.org/abs/2310.15645 · HTML: https://mlsanity.com/paper/2310.15645/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 63 references that are in the map.
- First posted on arXiv 24 Oct 2023.

## Builds on (most cited first, 5 of 5)

- [Dos and Don'ts of Machine Learning in Computer Security](https://mlsanity.com/paper/2010.09470/) (2020)
- [Survey of Network Intrusion Detection Methods from the Perspective of the Knowledge Discovery in Databases Process](https://mlsanity.com/paper/2001.09697/) (2020)
- [N-opcode Analysis for Android Malware Classification and Categorization](https://mlsanity.com/paper/1607.08149/) (2016)
- [A New Android Malware Detection Approach Using Bayesian Classification](https://mlsanity.com/paper/1608.00848/) (2016)
- [Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learning](https://mlsanity.com/paper/2205.12569/) (2022)

## Built on by (most cited first, 1 of 1)

- [MAECO-Lite: Modular Ontology for Dynamic Malware Analysis](https://mlsanity.com/paper/2605.31199/) (2026)

## Abstract (arXiv)

Malware authors have seen obfuscation as the mean to bypass malware detectors based on static analysis features. For Android, several studies have confirmed that many anti-malware products are easily evaded with simple program transformations. As opposed to these works, ML detection proposals for Android leveraging static analysis features have also been proposed as obfuscation-resilient. Therefore, it needs to be determined to what extent the use of a specific obfuscation strategy or tool poses a risk for the validity of ML malware detectors for Android based on static analysis features. To shed some light in this regard, in this article we assess the impact of specific obfuscation techniques on common features extracted using static analysis and determine whether the changes are significant enough to undermine the effectiveness of ML malware detectors that rely on these features. The experimental results suggest that obfuscation techniques affect all static analysis features to varying degrees across different tools. However, certain features retain their validity for ML malware detection even in the presence of obfuscation. Based on these findings, we propose a ML malware detector for Android that is robust against obfuscation and outperforms current state-of-the-art detectors.