Abstract: Known malicious Android applications are collected and their functions are extracted. Similarity values are calculated between pairs of functions and those functions with a low similarity value are grouped together and assigned a unique similarity identifier. A common set of functions or common set of similarity identifiers are identified within the applications. If at least one function in the common set is determined to be malicious then the common set is added to a blacklist database either by adding functions or by adding similarity identifiers. To classify an unknown Android application, first the functions in the application are extracted. These functions are then compared to the set of functions identified in the blacklist database. If each function in the set of functions is present (either by matching or by similarity) in the group of extracted functions from the unknown application then the unknown application is classified as malicious.

Abstract: A method for detecting malware in a computer that employs a production operating system during normal use is provided. The method includes activating on the computer a first operating system while the production operating system is dormant and ascertaining at least a portion of the production operating system that would be involved in booting up the computer if the production operating system had been activated instead. The method further includes scanning, while the first operating system is activated and while the production operating system is dormant, the portion of the production operating system. The method further includes neutralizing, while the first operating system is activated and while the production operating system is dormant, the malware responsive to the scanning.