Detection and Visualization of Android Malware Behavior

Figure 4

The simplified dendrogram of the malware FlakePlayer has been generated using the D3. Note that at the upper left corner of the figure there is a combobox to select the monitored malware (here, for simplicity, we use a shortened version of package name of the app, i.e., androidapplication1). Besides, lining up to the right of the combobox, there are three activated checkboxes, labeled as Goodware in blue, Adware in orange, and Malware in red. Also, at the upper right corner of the figure, there is a search button that allows us to look for classes or functions. The complete package name of the malware FakePlayer is org.me.androidapplication1.MoviePlayer.