Detection and Visualization of Android Malware Behavior

Figure 7

Visualization of the malicious API calls detected by our system for DroidKungFu1. Note the chosen options of the monitored malware in the dendrogram at the upper left side. First, we shorten version of the package name (wordsXGN) of the malware in the combobox. Next we have three checkboxes, namely, Goodware, Adware, and Malware. In this graph, only the red checkbox has been activated in order to conduct the visual analysis. The full package name of DroidKungFu1 is com.nineiworks.wordsXGN.