  According to the Symantec and F-Secure threat reports, mobile malware
development in 2013 and 2014 has continued to focus almost exclusively ~99% on
the Android platform. Malware writers are applying stealthy mutations
(obfuscations) to create malware variants, thwarting detection by signature
based detectors. In addition, the plethora of more sophisticated detectors
making use of static analysis techniques to detect such variants operate only
at the bytecode level, meaning that malware embedded in native code goes
undetected. A recent study shows that 86% of the most popular Android
applications contain native code, making this a plausible threat. This paper
proposes DroidNative, an Android malware detector that uses specific control
flow patterns to reduce the effect of obfuscations, provides automation and
platform independence, and as far as we know is the first system that operates
at the Android native code level, allowing it to detect malware embedded in
both native code and bytecode. When tested with traditional malware variants it
achieves a detection rate (DR) of 99.48%, compared to academic and commercial
tools' DRs that range from 8.33% -- 93.22%. When tested with a dataset of 2240
samples DroidNative achieves a DR of 99.16%, a false positive rate of 0.4% and
an average detection time of 26.87 sec/sample.
