Follow stream · CASE 01 · Malware Analysis · Research · Independent research project

MALINT-X

Android malware intelligence: static, dynamic, explained.

Active research

In development. The design is set; there are no experimental results to report yet.

A research project that investigates Android malware through static and dynamic analysis, systematic feature extraction and intelligent (ML-assisted) analysis.

Source not public yet

01 Lab

No lab for this file. It is at the active research stage, and a demo will be added only once there is real behaviour to show.

02 Brief

The problem

Android malware is often repackaged into legitimate-looking apps, and signature matching alone misses variants. An analyst needs evidence from two sides: what the APK declares and contains, and what it does when it runs. Then the analyst needs a way to combine both into a judgement they can defend.

Why it matters

Every project in this archive asks what an artefact really is behind what it presents. A mobile app is the most personal version of that question: it sits in someone's pocket with their permissions.

03 Architecture

A planned two-lane pipeline that mirrors how an analyst works. Static evidence and runtime evidence are extracted separately, then fused into features for analysis.

MALINT-X planned pipeline: an APK sample is analysed in a static lane (manifest and permissions, DEX and API calls) and a dynamic lane (instrumented run, runtime behaviour). Both feed feature extraction, then model-assisted analysis that produces an explained verdict.STATIC LANEDYNAMIC LANEAPK sampleinputManifest + permissionsDEX / API-call stringsInstrumented executionRuntime behaviournetwork · files · permsFeaturesnormalisedAnalysismodel-assistedVerdict+ explanation
FIG. 01Planned two-lane analysis pipeline
  1. 01

    Static lane

    Manifest and permission analysis, component inventory, API-call and string extraction from the APK.

  2. 02

    Dynamic lane

    Instrumented execution to observe runtime behaviour: network activity, file and permission use.

  3. 03

    Feature extraction

    Normalising both lanes into a consistent feature representation per sample.

  4. 04

    Intelligent analysis

    Model-assisted classification with explanations an analyst can audit.

04 Implementation

Stack

Python · Android tooling · Static analysis · Dynamic analysis · Machine learning

  • Scoping the analysis pipeline and the feature set for static and dynamic evidence.
  • Designing the separation between extracted facts and model-derived estimates, a principle carried over from IPsec Sentinel.

05 Engineering decisions

  1. Two lanes, kept apart

    Static and dynamic evidence are extracted independently, so either can be audited on its own before they are combined.

06 Evidence

No published results yet. This file is at the active research stage, and results will be added once they can be backed by evidence.

Sourced from: Brief (project description). No public repository yet.