Hybrid Static–Dynamic Analysis Framework for Detecting SMS-OTP Interception Malware on Android Devices

Abstract

The rapid growth of Android applications has significantly increased the risk of malware capable of intercepting SMS-based One-Time Passwords (OTPs), leading to financial fraud, identity theft, and unauthorized access to sensitive user accounts. Traditional Android malware detection approaches primarily rely on static permission analysis or signature-based detection techniques, which are often insufficient to identify emerging malware variants and applications requesting excessive sensitive permissions. To address these limitations, this paper proposes a Hybrid Static– Dynamic Analysis Framework for Detecting SMS-OTP Interception Malware on Android Devices. The proposed framework integrates Python, Flask, Androguard, Android Studio, Java, Android SDK, and Android PackageManager APIs to perform APK analysis, permission extraction, installed application analysis, risk score calculation, and security report generation. Static analysis examines uploaded APK files by extracting manifest information, application components, and sensitive permissions, while the device-level analysis module evaluates installed Android applications using PackageManager APIs to identify risky permissions and calculate security scores. The framework classifies applications into Safe, Medium Risk, and High Risk categories based on predefined risk assessment rules and generates comprehensive security reports for end users. Experimental results demonstrate that the proposed framework effectively identifies security-sensitive applications, improves Android security awareness, and provides an economical solution for Android malware assessment suitable for academic research and practical mobile security applications.