Background: security has become a major concern for smartphone users in line with the increasing use of mobile applications, which can be downloaded from unofficial sources. These applications make users vulnerable to penetration and viruses. Malicious software (malware) is unwanted software that is frequently used by cybercriminals to launch cyber-attacks. Therefore, the motive of the research was to detect malware early before infection by discovering it at the application-design level and not at the code level, where the virus will have already damaged the system. Methods: in this article, we proposed a malware detection method at the design level based on reverse engineering, the unified modeling language (UML) environment, and the web ontology language (OWL). The proposed method detected “Data_Send_Trojan” malware by designing a UML model that simulated the structure of the malware. Then, by generating the ontology of the model, and using RDF query language (SPARQL) to create certain queries, the malware was correctly detected. In addition, we proposed a new classification of malware that was suitable for design detection. Results: the proposed method detected Trojan malware that appeared 552 times in a sample of 600 infected android application packages (APK). The experimental results showed a good performance in detecting malware at the design level with precision and recall of 92% and 91%, respectively. As the dataset increased, the accuracy of detection increased significantly, which made this methodology promising.

Malicious software (malware) can steal passwords, leak details, and generally cause havoc with users’ accounts. Most of the current malware detection techniques are designed to detect malware at the code level of the software, where it is actually infected and causes damage. Additionally, current malware detection techniques at the design level are done manually or semi-automatically. This research aims to enhance these methods to detect malware at the design level automatically with a big dataset. The proposed method presents an automatic system for detecting SMS (Short Message Service) malware at the design which is called APKOWL. It is based on reverse engineering of the mobile application and then automatically builds OWL (web ontology Language) ontology. The proposed system is implemented in python and Protégé, and its performance has been tested and evaluated on samples of android mobile applications including 3,904 malware and 3,200 benign samples. The experimental results successfully verify the effectiveness of the proposed method because it has good performance in detecting SMS malware at the software design level. The proposed method obtained an accuracy of 97%, precision of 97.5%, and recall of 99%, outperforming the compared model in all performance metrics.