Mystique proceeds in five stages to generate a compiled app: feature selection, construction of malicious behavior, code assembly, compilation (we use Gradle to compile the Android app) and vetting process (runtime of AMTs). We provide the following table to show the runtime for each step.
As Table 1 shows, it takes on 204.3ms on average to generate the source code of one app. The compilation process takes around 13.8s to finish. Therefore, our service of producing an valid app only cost 14s, given the basic configuration of features of the app. During the malware evolution, we use AMTs to identify the detection ratio of each generated app, which takes 58.7m on average.
Table 1. The runtime for each step in malware generation and detection by AMTs