Malware classification in mobile Android platforms: background, concepts and traditional methods

With technological advances, mobile devices are increasingly functional and widely used, with society becoming dependent on them. Mobile devices are used by all age groups and in different contexts, such as educational, commercial, business, and leisure. Mobile device users often hold personal and confidential data that cannot be exposed, and there is a growing concern that this information could be used maliciously. These devices are potentially susceptible to threats similar to those that affect desktop and laptop computers connected to the internet, so protecting users from harm caused by malicious applications becomes important. Therefore, this survey addresses the problem of malware classification in mobile devices. We focus on devices with the Android operating system, which is used in most of these devices, with a market share of slightly more than 70%. This survey provides background information on mobile Android platforms and related malware and presents an overview of methods for Android malware analysis. Then, it explores previously published traditional methods used for malware classification. We pay particular attention to traditional machine learning and other traditional classification methods and their application using static, dynamic, or hybrid malware analysis. Furthermore, this survey also addresses malware prevention methods and evasion studies. Due to the length of this article, we focus here on traditional classification methods, leaving methods based on deep learning or on large language models for another article.