Androbank: the impact of API levels on mobile malware detection

Abstract

Android is the most widely used operating system, making it a prime target for mobile malware, leading to data breaches and financial losses (e.g., Dark Herring). To address these issues, AI-based forensic tools are crucial for investigating security incidents, but their accuracy depends on high-quality mobile malware datasets. While dynamic analysis has limitations, recent research has shifted towards static analysis and AI-based methods for malware detection. However, there are three key challenges: lack of reproducibility, low dataset quality, and bias in AI datasets. This paper focuses on an overlooked bias—the incorrect API Level distribution in malware datasets. Such bias skews AI detection results, making them appear effective in tests but less applicable in real-world scenarios. To highlight the importance of dataset quality, three case studies on API Level Analysis were conducted, showing how biased datasets can distort detection results. To address this, the paper introduces methods and terms like Delayed Interception, Dataset of guaranteed quality, API Milestones, AndroBank, and Sample Unification, which aim to enhance dataset reliability and improve AI-based mobile malware detection.