A framework for automated extraction of static and dynamic features from Android APKs for malware detection.
AndroPyTool is a framework for automated extraction of static and dynamic features from Android APK files. It integrates multiple analysis tools like DroidBox, FlowDroid, and AndroGuard to perform comprehensive app analysis, outputting structured feature data for tasks like malware detection. It solves the problem of manually orchestrating disparate Android analysis tools into a single, reproducible pipeline.
Security researchers, malware analysts, and data scientists working on Android application security, particularly those building datasets or machine learning models for malware classification.
Developers choose AndroPyTool because it provides a pre-integrated, automated pipeline combining leading open-source Android analysis tools, saving significant setup and orchestration time. Its ability to output standardized feature formats (JSON/CSV) and integrate with MongoDB makes it ideal for scalable security research workflows.
A framework for automated extraction of static and dynamic features from Android applications
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Integrates DroidBox, FlowDroid, AndroGuard, and VirusTotal into a single pipeline, reducing manual effort to combine these tools, as highlighted in the README's feature list.
Processes multiple APKs from a source directory with configurable steps like filtering and cleanup, enabling efficient analysis of large datasets for research.
Generates feature data in JSON and CSV formats, and supports MongoDB export, making it easy to integrate with data science and machine learning pipelines, as noted in the README.
Provides a pre-built Docker image for quick deployment, which the README recommends as the preferred installation method to avoid complex setup.
Installing from source requires multiple steps, specific dependencies like Android SDK and Java 8, and is only tested on Ubuntu, making it inaccessible for non-Linux users or those unfamiliar with system configuration.
Dynamic analysis relies on DroidBox with Android 16, an old API version, which may not accurately model modern app behavior and limits relevance for current Android versions.
VirusTotal integration requires an API key and external service, introducing potential costs, usage limits, and reliability issues for continuous analysis.