Implementation of Reverse Engineering Techniques for Malware Risk Level Categorization Using Simple Additive Weighting

Abstract

The rapid growth of Android devices has been accompanied by an increasing number of malware threats, particularly spyware that can steal sensitive user information. This study aims to classify the risk level of Android spyware using reverse engineering techniques, VirusTotal API integration, and the Simple Additive Weighting (SAW) method. Reverse engineering is performed to extract internal malware attributes such as the number of permissions and the category of dangerous permissions from APK files. In addition, external attributes are obtained through VirusTotal API integration, including the number of antivirus engines detecting the malware and the threat category. These attributes are then processed using the SAW method to generate preference values used for classifying spyware risk levels into low, medium, and high categories. The malware sample used in this study is AhMyth, which represents Android spyware. The results indicate that the developed system is capable of providing systematic spyware risk classification and presenting more informative risk information to users. This research is expected to improve user awareness of spyware threats and support the development of more informative malware detection systems