  This paper introduces a malware detection system for smartphones based on
studying the dynamic behavior of suspicious applications. The main goal is to
prevent the installation of the malicious software on the victim systems. The
approach focuses on identifying malware addressed against the Android platform.
For that purpose, only the system calls performed during the boot process of
the recently installed applications are studied. Thereby the amount of
information to be considered is reduced, since only activities related with
their initialization are taken into account. The proposal defines a pattern
recognition system with three processing layers: monitoring, analysis and
decision-making. First, in order to extract the sequences of system calls, the
potentially compromised applications are executed on a safe and isolated
environment. Then the analysis step generates the metrics required for
decision-making. This level combines sequence alignment algorithms with
bagging, which allow scoring the similarity between the extracted sequences
considering their regions of greatest resemblance. At the decision-making
stage, the Wilcoxon signed-rank test is implemented, which determines if the
new software is labeled as legitimate or malicious. The proposal has been
tested in different experiments that include an in-depth study of a particular
use case, and the evaluation of its effectiveness when analyzing samples of
well-known public datasets. Promising experimental results have been shown,
hence demonstrating that the approach is a good complement to the strategies of
the bibliography.
