  Despite the growing threat posed by Android malware, the research community
is still lacking a comprehensive view of common behaviors and trends exposed by
malware families active on the platform. Without such view, the researchers
incur the risk of developing systems that only detect outdated threats, missing
the most recent ones. In this paper, we conduct the largest measurement of
Android malware behavior to date, analyzing over 1.2 million malware samples
that belong to 1.2K families over a period of eight years (from 2010 to 2017).
We aim at understanding how the behavior of Android malware has evolved over
time, focusing on repackaging malware. In this type of threats different
innocuous apps are piggybacked with a malicious payload (rider), allowing
inexpensive malware manufacturing.
  One of the main challenges posed when studying repackaged malware is slicing
the app to split benign components apart from the malicious ones. To address
this problem, we use differential analysis to isolate software components that
are irrelevant to the campaign and study the behavior of malicious riders
alone. Our analysis framework relies on collective repositories and recent
advances on the systematization of intelligence extracted from multiple
anti-virus vendors. We find that since its infancy in 2010, the Android malware
ecosystem has changed significantly, both in the type of malicious activity
performed by the malicious samples and in the level of obfuscation used by
malware to avoid detection. We then show that our framework can aid analysts
who attempt to study unknown malware families. Finally, we discuss what our
findings mean for Android malware detection research, highlighting areas that
need further attention by the research community.
