  With the number of new mobile malware instances increasing by over 50\%
annually since 2012 [24], malware embedding in mobile apps is arguably one of
the most serious security issues mobile platforms are exposed to. While
obfuscation techniques are successfully used to protect the intellectual
property of apps' developers, they are unfortunately also often used by
cybercriminals to hide malicious content inside mobile apps and to deceive
malware detection tools. As a consequence, most of mobile malware detection
approaches fail in differentiating between benign and obfuscated malicious
apps. We examine the graph features of mobile apps code by building weighted
directed graphs of the API calls, and verify that malicious apps often share
structural similarities that can be used to differentiate them from benign
apps, even under a heavily "polluted" training set where a large majority of
the apps are obfuscated. We present DaDiDroid an Android malware app detection
tool that leverages features of the weighted directed graphs of API calls to
detect the presence of malware code in (obfuscated) Android apps. We show that
DaDiDroid significantly outperforms MaMaDroid [23], a recently proposed malware
detection tool that has been proven very efficient in detecting malware in a
clean non-obfuscated environment. We evaluate DaDiDroid's accuracy and
robustness against several evasion techniques using various datasets for a
total of 43,262 benign and 20,431 malware apps. We show that DaDiDroid
correctly labels up to 96% of Android malware samples, while achieving an 91%
accuracy with an exclusive use of a training set of obfuscated apps.
