EMULATOR vs REAL PHONE: Android Malware Detection Using Machine Learning

Mohammed K. Alzaylaee, Suleiman Y. Yerima, Sakir Sezer

Research output: Chapter in Book/Report/Conference proceedingConference contribution

33 Citations (Scopus)
1620 Downloads (Pure)


The Android operating system has become the most popular operating system for smartphones and tablets leading to a rapid rise in malware. Sophisticated Android malware employ detection avoidance techniques in order to hide their malicious activities from analysis tools. These include a wide range of anti-emulator techniques, where the malware programs attempt to hide their malicious activities by detecting the emulator. For this reason, countermeasures against anti-emulation are becoming increasingly important in Android malware detection. Analysis and detection based on real devices can alleviate the problems of anti-emulation as well as improve the effectiveness of dynamic analysis. Hence, in this paper we present an investigation of machine learning based malware detection using dynamic analysis on real devices. A tool is implemented to automatically extract dynamic features from Android phones and through several experiments, a comparative analysis of emulator based vs. device based detection by means of several machine learning algorithms is undertaken. Our study shows that several features could be extracted more effectively from the on-device dynamic analysis compared to emulators. It was also found that approximately 24% more apps were successfully analysed on the phone. Furthermore, all of the studied machine learning based detection performed better when applied to features extracted from the on-device dynamic analysis.
Original languageEnglish
Title of host publicationIWSPA '17: Proceedings of the 3rd ACM on International Workshop on Security And Privacy Analytics
PublisherAssociation for Computing Machinery (ACM)
Number of pages8
ISBN (Print)978-1-4503-4909-3/17/03
Publication statusPublished - 24 Mar 2017
EventACM international workshop on security and privacy analytics, colocated with ACM CODASPY 2017, - Arizona, Scottsdale, United States
Duration: 22 Mar 201724 Mar 2017


ConferenceACM international workshop on security and privacy analytics, colocated with ACM CODASPY 2017,
Abbreviated titleIWSPA 2017
CountryUnited States


  • Android malware
  • Android
  • machine learning
  • malware detection
  • malware analysis
  • Emulation
  • device-based detection

Fingerprint Dive into the research topics of 'EMULATOR vs REAL PHONE: Android Malware Detection Using Machine Learning'. Together they form a unique fingerprint.

Cite this