Evaluating the Effectiveness of the Mining Android Sandbox (MAS) Approach for Malicious App Detection in Large Datasets

The widespread use of smartphones, particularly Android devices, has raised significant security concerns. The Mining Android Sandbox (MAS) approach has been used to identify malicious behavior in repackaged Android applications, but its effectiveness has been ques- tioned due to the limited size of previous datasets. This paper presents a replication study with a significantly larger dataset comprising 4,076 pairs of original and repackaged apps, covering a wider variety of Android malware families. Contrary to previous findings, we observe a sharp de- cline in the MAS approach’s accuracy, with the F1-score dropping from 0.89 to 0.54. Our analysis reveals that the higher representation of certain malware families in the larger dataset contributes to the MAS approach’s reduced accuracy. The study highlights the limitations of the MAS ap- proach when scaled and emphasizes the need for integrating additional techniques to enhance malware detection across diverse app variants.