%PDF-1.5 % 4 0 obj << /S /GoTo /D (section.1) >> endobj 7 0 obj (I Introduction) endobj 8 0 obj << /S /GoTo /D (section.2) >> endobj 11 0 obj (II The MaMaDroid System) endobj 12 0 obj << /S /GoTo /D (subsection.2.1) >> endobj 15 0 obj (II-A Overview) endobj 16 0 obj << /S /GoTo /D (subsection.2.2) >> endobj 19 0 obj (II-B Call Graph Extraction) endobj 20 0 obj << /S /GoTo /D (subsection.2.3) >> endobj 23 0 obj (II-C Sequence Extraction) endobj 24 0 obj << /S /GoTo /D (subsection.2.4) >> endobj 27 0 obj (II-D Markov-chain Based Modeling) endobj 28 0 obj << /S /GoTo /D (subsection.2.5) >> endobj 31 0 obj (II-E Classification) endobj 32 0 obj << /S /GoTo /D (section.3) >> endobj 35 0 obj (III Datasets) endobj 36 0 obj << /S /GoTo /D (section.4) >> endobj 39 0 obj (IV Evaluation) endobj 40 0 obj << /S /GoTo /D (subsection.4.1) >> endobj 43 0 obj (IV-A Preliminaries) endobj 44 0 obj << /S /GoTo /D (subsection.4.2) >> endobj 47 0 obj (IV-B Detection Performance) endobj 48 0 obj << /S /GoTo /D (subsection.4.3) >> endobj 51 0 obj (IV-C Detection Over Time) endobj 52 0 obj << /S /GoTo /D (subsection.4.4) >> endobj 55 0 obj (IV-D Case Studies of False Positives and Negatives) endobj 56 0 obj << /S /GoTo /D (subsection.4.5) >> endobj 59 0 obj (IV-E MaMaDroid vs DroidAPIMiner) endobj 60 0 obj << /S /GoTo /D (subsection.4.6) >> endobj 63 0 obj (IV-F Runtime Performance) endobj 64 0 obj << /S /GoTo /D (section.5) >> endobj 67 0 obj (V Discussion) endobj 68 0 obj << /S /GoTo /D (subsection.5.1) >> endobj 71 0 obj (V-A Lessons Learned) endobj 72 0 obj << /S /GoTo /D (subsection.5.2) >> endobj 75 0 obj (V-B Evasion) endobj 76 0 obj << /S /GoTo /D (subsection.5.3) >> endobj 79 0 obj (V-C Limitations) endobj 80 0 obj << /S /GoTo /D (section.6) >> endobj 83 0 obj (VI Related Work) endobj 84 0 obj << /S /GoTo /D (subsection.6.1) >> endobj 87 0 obj (VI-A Program Analysis) endobj 88 0 obj << /S /GoTo /D (subsection.6.2) >> endobj 91 0 obj (VI-B Android Malware Detection) endobj 92 0 obj << /S /GoTo /D (section.7) >> endobj 95 0 obj (VII Conclusion) endobj 96 0 obj << /S /GoTo /D (section*.18) >> endobj 99 0 obj (References) endobj 100 0 obj << /S /GoTo /D [101 0 R /Fit] >> endobj 120 0 obj << /Length 6364 /Filter /FlateDecode >> stream x<˒Ƒw}E_fGkP/