1 Introduction

Today the market of smart phones, which we use like mobile phones, tends towards tremendous sustainable growth [16]. According to the International Data Corporation (IDC) Worldwide Quarterly Mobile Phone Tracker, total shipment volumes of smartphones increased by 13.2% year-over-year, with the 2020 recovery continuing with 313.2 million device shipments in the second quarter of 2021 [33].

One of the biggest factors in the popularity of smartphone use is the increase in functionality and the decrease the costs. In addition to offering many connection options such as Bluetooth, Wi-Fi, GPS, the fact that smartphones allow third-party applications to be installed expands the functionality limit. These applications are officially distributed by online stores. There are Google Play Store for the Android operating system and Apple App Store for iOS.

Attractive features such as unlimited internet access, numerous application options have become opportunities for malware developers. According to Kaspersky Security Network, 9,599,519 malware, adware, and riskware attacks on mobile devices were blocked in the third quarter of 2021 [43]. There are several ways of malware infection. They can be transmitted through a multimedia messaging service (MMS) or an email. They can also pose threats by exploiting vulnerabilities in-network or mobile devices. Users are most affected by downloading applications that contain malicious code.

Since 2019, there have been significant changes in education and business life due to the COVID 19 pandemic. This process, where online work from home has increased, has also provided an opportunity for malicious attacks. Due to the increase in communication over the Internet, data encryption and security have gained more importance. In addition, the expansion of the digital world, and the increase in the size of multimedia contents, along with encryption and security operations, have brought to the fore effective and efficient data summarization. Current studies in the field of data encryption and summarization continue increasingly.

Koppanati and Kumar [23] developed a polynomial cohesion-based multimedia encryption technique (P-MEC) over the cloud. With this technique, which they developed by focusing on cubic and polynomial compatibility, they proved that multimedia data is better protected over the cloud than some existing models. Rayappan and Pandiyan [38] developed a lightweight Feistel structure-based substitution permutation crypto model to secure multimedia data on the cloud. They confirmed that this model, developed by leveraging the effectiveness of the block cipher approach, is suitable for secure multimedia data communication over the cloud. Since the model is resistant to different attack resistances, it can be used safely in an uncertain cloud environment. Jayapandian [20] proposed a method that provides the best encryption method to reduce the encoding and decoding time in multimedia data. This method proved to reduce the application time by more than 50%. It also provided the highest data security in multimedia data and reduce overall execution time in dynamic cloud tasks. Gupta et al. [17] proposed an advanced identity-based encryption approach that hides the identity of users using the Lagrange coefficient consisting of a polynomial interpolation function. They showed that this method takes less time in encryption and decryption compared to the competitive method. Kumar [25] has developed a method of generating event summaries in a cloud environment to help users access large volumes of video data effectively. It proved that the method with event summarization and event search outperformed the models with the best F-measure. Lalotra et al. [27] proposed a new method called iReTADS. With the summarization technique, they aimed to reduce network traffic and ensure network security through a real-time neural network. Experimental results showed that iReTADS is effective in monitoring network traffic and detecting anomalies. They also suggested that the developed method could also benefit efforts to control pandemics using medical datasets for smart healthy cities.

The main aim and contribution of this study are to collect the current state of mobile security and highlight the future of mobile security in light of the recent mobile security threat reports. The studies in the field of malware, attack types, and security vulnerabilities concerning the usage of smartphones were analyzed. The malware detection techniques were analyzed into two categories: signature-based and machine learning (behavior detection)-based techniques. Additionally, the current threats and prevention methods were described. Finally, a future direction is highlighted in the light of the current mobile security reports.

The remainder of this paper is organized as follows: Types of malwares and types of malicious attacks and mobile vulnerabilities are explained in Sections 2 and 3, respectively. In Section 4, the security solutions to be taken against mobile malware, and threat detection techniques are reviewed. Finally, the paper is concluded by how security studies will lighten the future in Section 5.

2 Types of malwares

Program pieces written with the aim of stealing users’ information and damaging the system by attacking them are called malicious programs. Malicious programs can be identified in two categories: threats that require host programs and threats that are independent of each other [10]. The first is a piece of program linked to an application or program. The other is an independent program run by the system.

In addition, mobile malware can be divided into three groups according to its behavior: propagation behavior, remote control behavior, and malicious attack behavior [46]. The propagation behavior refers to the access of the malware to the users, the remote-control behavior refers to the use of the remote server, and the attack behavior refers to the attacking of the users with different applications after infecting their devices.

Various types of mobile malware exist. Table 1 highlights the most common types of mobile malware with names and their descriptions.

Table 1 Typical malware apps
Full size table

As previously mentioned, in the third quarter of 2021, 9,599,519 attacks on mobile devices were detected, including malware, adware, and riskware. Among all detected mobile threats, RiskTool applications constitute the largest share with a rate of 65.84%. Apart from that, 676,190 malware packages were detected. 12,097 of them are packaged mobile banking trojans, and 6.157 of them are packaged mobile ransomware trojans [43].

2.1 Popular malwares

The Android operating system is more exposed to malicious attacks due to the high number of users and is open source based. The Apple iOS platform, on the other hand, is less exposed to malicious threats than the Android platform. In this section, the most known malicious threats to smartphones are summarized and given in Table 2.

Table 2 Popular malwares
Full size table

The HummingBad family was discovered by Check Point in February 2016. It secretly installs a rootkit on Android devices. It also earns advertising revenue with fake applications that look real. According to analysts’ determination, it is estimated to generate $300,000 monthly income [30]. HummingBad was discovered by Check Point in 2016 [12]. It has reached more than 85 million downloads. Surveillance or Pegasus is spyware that affects all Wechat users that can infect Android and iOS operating systems from social media platforms. This malware takes control of the device to obtain sensitive information. The malicious app, called Surveillance or Pegasus, was discovered by Citizen Lab in 2016. It affected Android and iOS operating systems [2].

Swearing is a trojan discovered by Tencent Researchers in 2017 that steals personal and important data from victims, infects the Android operating system, and has over 100,000 downloads [39]. Gooligan was discovered by Check Point in 2016 [39]. It is a rootkit that infects Android operating systems and causes security weakness in more than 1 million Google accounts. FalseGuide was discovered by Check Point in 2016 [37]. Infecting Android and iOS operating systems, this malware places botnets on people’s devices for malicious advertising purposes. Triada was discovered by Kaspersky and Check Point. Infecting Android operating systems, this malware uses a backdoor to steal money from victims. A SMS trojan bypasses CAPTCHA and steals money [28].

Hiddad is one of the malwares discovered by Check Point and Kaspersky in 2017. It is a trojan used to gain access to confidential personal data. It is effective on Android operating systems. Ztorg is a trojan that attacks Android operating systems, discovered by Kaspersky in 2016. Like others, it steals user login information by installing fake apps via Google Play and other application markets. DressCode malware was discovered by Kaspersky in 2016. Infecting Android operating systems, this malware creates botnets for malicious attackers who create fake network traffic using IP addresses, allowing them to generate revenue.

Discovered in 2016, the Godless malware family silently installs itself on Android devices. Causes annoying ads and apps to get remote instructions and gain root privilege [31]. Discovered in 2017, the Bad Rabbit malware family is a ransomware-type threat that targets Android devices. Installed and deployed, this threat collects bitcoins from the victim in exchange for releasing resources [24]. Discovered by Wandera’s security researcher in 2018, RedDrop malware is a family of spyware threats that target Android devices. It is a threat that can steal the victim’s device information, files, images, and audio recordings [7]. Of the thousands of malware families discovered by G Data experts in 2019, the most popular is GandCrab, a ransomware-type malware with over 408,000 versions [4]. Malwares named njRAT and BlackShades, versions 208,000 and 193,000 respectively, both used by malware developers to gain administrative control of the victim’s device, were discovered by G Data experts in 2019 [4].

In 2020, experts at TrendMicro found that Apple WebKit vulnerabilities were used for remote code execution. This malicious threat was a trojan named LightSpy, which was distributed using news portals such as COVID-19 update sites. It targeted iOS devices to steal personal information, take screenshots and identify nearby Wi-Fi networks [8]. One of the popular mobile malwares of 2020 is xHelper, which targets the Android platform. Discovered by Check Point, this malware can download other malicious apps, display ads, and reinstall itself when deleted [36]. One of the most popular malware families of 2020, identified by Check Point, is the Xafecopy trojan. Xafecopy disguises itself as useful apps, installing malware on the device. He clicks on web pages with Wireless Application Protocol (WAP) billing, a form of mobile payment, and reflects it on the victim’s cell phone bill [36]. According to the 2021 report by Check Point experts, the most popular malware was Trickbot, infecting 4% of the world’s organizations. TrickBot emerged in 2016 as a Trojan threat designed to trick financial services and online banking users [40].

3 Types of malicious attacks and mobile vulnerabilities

3.1 Types of malicious attacks

A malicious attack (threat) is an attempt to abuse and exploit another computer by various means. These are threats to access personal data without the victim’s knowledge and to take control of the device.

There are three types of threats including phishing, social engineering, and MITM.

  1. 1.

    Social engineering is a type of threat made by malicious social engineers to obtain your personal information from you by imitating the script (prosecutor, police, banker). Social engineering threats on smartphones often occur through advertising. Malware is often secretly embedded in the content of adware and can be run independently of the user.

  2. 2.

    Phishing apps are fake apps that pretend to be a real secure app on the user’s smartphone, trying to get hold of a person’s login password and other information.

  3. 3.

    A man-in-the-middle attack (MITM) is the eavesdropping of communication between two links to capture and manipulate packets on the network. With this attack, the connection can be interrupted, or misleading communication can be created.

3.2 Mobile vulnerabilities

Vulnerabilities in mobile devices are a flaw in the operating system that makes the device vulnerable to attack. There are various reasons why Android and iOS mobile devices become vulnerable to threats. In particular, the fact that the Android operating system is more exposed to attacks is due to the fact that it is an open-source operating system. Neglecting to make regular updates, installing applications from official application stores or third-party stores without checking their authenticity cause security vulnerabilities. Victims can still be attacked, even if downloaded from protected stores such as the Apple Store and Google Play, as malicious hackers can place threatening code on the cover of a real app.

In 2020, 18,353 vulnerabilities were identified in the Common Vulnerabilities and Exposures (CVE) list. These record numbers are nearly four years in a row, more than triple the five years ago [34]. According to the Synopsys Cybersecurity Research Center (CyRC) report, 97% of software and systems tested during 2020 were found to contain security vulnerabilities. Mobile devices are threatened by vulnerabilities in insecure data storage and communication. Of the vulnerabilities, 80% were related to insecure data storage and 53% were related to unsecured communication [1, 45].

4 Security solutions against mobile malware and threats

Today, with the increasing use of mobile devices, cybercriminals have begun to target mobile devices more than personal computers and laptops. A two-step method can be followed to protect mobile devices from malware and threats. First, preventive measures can be taken. Security measures should be taken to prevent attacks and malware infection on mobile devices. In the second stage, various tools can be used to detect the presence of malicious software.

The remainder of this section reviews techniques for detecting and blocking malware. It also offers some measures to minimize malware attacks.

4.1 Malware detection techniques

Techniques such as file access permission and sandboxing were applied to take security measures on Android and iOS mobile devices. However, they have been insufficient in preventing attacks that have recently increased and continue to increase.

Malicious attacks tripled from 2015, reaching over 8 million in 2016, causing more than $100 million in lost money worldwide [26]. In 2020, SonicWall Capture Labs threat researchers recorded 5.6 billion malware attacks. This figure is a huge decrease compared to the previous year. However, this situation cannot be seen as a success. Because, with many people starting to work from home, cyber security providers are gradually losing the ability to monitor traffic and potential attacks. So this number could be much higher [15].

Researchers have divided malware detection techniques into two categories: signature-based and machine learning (behavior detection)-based techniques. The summary of the malware detection techniques is given in Table 3.

Table 3 Malware detection techniques
Full size table

4.1.1 Signature based techniques

The signature-based technique is a technique for detecting and identifying certain patterns of malware, called signatures. The way of work this type of method is explained as follows: Generates a new signature by comparing a newly defined signature with existing signatures in the database. The downside of this technique is that if malware developers make minor changes to the new version of their app, the signature won’t work. The comparison of the signature is made by overlapping.

Tchakounté et al. [47] developed an analysis tool called LimonDroid to identify malicious characters in Android apps. Using Yet Another Recursive/Ridiculous Acronym (YARA) [32] rules, this tool exposed malicious characters of Metasploit, Fake Apps, LeadBolt, Ransomware, RuMMS, Viking Horde, and XBot in scanned applications. Studies show that LimonDroid outperforms existing similarity-based solutions. It can also predict the class of an application with 97.82% accuracy. Dimolianis et al. [13] have presented an integrated scheme for signature-based traffic classification processing for DDoS protection. With this signature-based scheme, it outperformed traditional IP-based schemes in terms of malicious traffic categorization, cardinality of filtering rules, and packet processing efficiency in high-speed networks. The AMD framework, developed by Patil et al. [35], includes a VM operator that detects known malware with signature and anomaly detection techniques. The downside is that due to its distributed and dynamic nature, it includes security issues for cloud computing. VMs were over 96% successful in detecting malware. Thus, it secured the high-risk VMs of cloud computing. FOSS (Free and Open Source Software) performs a file system scan based on Nessus and YARA signatures developed by Jaramillo [19]. This application is developed against Mirai botnets, which are malware that includes DDoS attacks, damaging banking systems. Nessus is not open source and is low-cost. Savenko et al. [42] have done a study that generates virus signatures based on API call tracing. The recommended signature format for detecting malware allows distinguishing malicious applications from other applications by key API calls. Up to 96.56% success was achieved in the trial results. Venugopal and Hu [48] have detailed a signature matching algorithm used in mobile device scanning. They developed their proposed signature-based malware detection method for low-memory mobile devices. This algorithm provides fast scanning and consumes less than 50% of memory compared to the Clam-AV scanner. Jeong et al. [21] presented a real-time malware detection software that named as SafeGuard. Shrivastava and Kumar [44] presented a Android Intent and permission based software that named as SensDroid.

4.1.2 Machine learning-based techniques

Machine learning (behavioral) based techniques are widely used in cyber security applications. Using this technique on a benign malware dataset, both unforeseen and known threats can be detected. Machine learning-based methods are preferred by many researchers in cyber security products, especially since they are more successful than signature-based methods in detecting zero-day attacks. In this section, we examine studies in which machine learning-based methods are used as a tool in malware analysis studies.

In their study of machine learning-based mobile malware detection using highly unstable network traffic, Chen et al. [9] confirmed that machine learning algorithms are effective in analyzing malicious mobile network traffic. Malicious mobile network traffic data is one of the well-known highly imbalanced datasets. However, they have shown that once the data imbalance reaches over 4000, no method can be effective on highly unstable problems. The proposed methods detect the malicious traffic flow in a very big benign traffic flow when the imbalance ratio is under 4000. Hatcher et al. [18] conducted mobile threat monitoring and detection studies using four machine learning methods (ZeroR, OneR, Naïve Bayes, and J48). As a result of the study, it was found that the best classifier could achieve 100% accuracy with a detection rate of 94.59%. Feizollah et al. [14] in their study comparing five types of machine learning classifiers (Naive Bayes, KNN, Decision Trees, MLP, and SVM) for anomaly-based mobile botnet detection, reached a detection rate of 99.94% with KNN. Wang et al. [49] have proposed Machine Learning-Assisted Secure Mobile Electronic PaymentFramework (ML-SMEPF) to detect malware, fraud, authentication issues in mobile transactions. They have proven the reliability of the framework in the simulation performed according to accuracy, safety, performance, and cost factor. Li et al. [29] highlighted the importance of mobile vehicle social networks (VSNs), which will provide a new method of code propagation with the evolution of 5G networks. They proposed the ‘‘Machine Learning based Code Dissemination by Selecting Reliability Mobile Vehicles in 5G Networks’’ (MLCD) to select lower-cost codes and code spreading tools with high reliability and coverage. In their study, they concluded that by comparing the MLCD scheme with other schemes, it can improve code propagation security by 83.6% and 18.86% with limited costs, and the coverage rate of updated information by 23.16% in 5G networks.

Sarker et al. [41] developed a machine learning-based cyber security attack detection model called IntruDTree. They tested the effectiveness of the model by conducting experiments on cyber security datasets. They analyzed the effectiveness of IntruDTree, a tree-based generalized intrusion detection model, by comparing it to traditional popular machine learning methods. They emphasized that the effectiveness of the model can be evaluated in IoT security services and cyber security in the future. Bosaeed et al. [5] have proposed a model on SMS Spam Detection and Classification System based on Fog Augmented Machine Learning. In this technique, in which they use three classification methods (Naïve Bayes (NB), Support Vector Machine (SVM), and Naive Bayes Multinomial (NBM)), it detects spam, especially from outgoing SMS messages. As a result of their studies, they found that the PF5 filter and SVM had the best performance in SMS classification. Kim et al. [22] proposed a Vulnerability Identification System (AVIS) that can identify malicious applications in advance using the Naïve Bayes classification algorithm. Arif et al. [3] proposed a multi-criteria decision-making based mobile malware detection system using a risk-based fuzzy analytical hierarchy process approach to evaluate the Android mobile application.

4.2 Security measures to protect from malware and threats

Software vulnerabilities in mobile devices, vulnerabilities in wireless networks, security flaws caused by user errors, and security flaws in mobile applications are factors that attract malicious attackers. Users, application developers, network designers, and application market managers have responsibilities to prevent the transmission of malware and threats to mobile devices.

Smartphones are small computers. Users should protect their phones from fake and adware containing malware. They should use a good malware framework like a firewall and download apps (games, marketing, etc.) only from trusted app markets (Apple Store and Google Play Store, etc.). In addition, features such as WiFi or Bluetooth should not be left open if they are not in use, to protect against malware that can be transmitted by proximity contact with peer-to-peer communication methods.

There is heavy user activity on networks around the world. Users may have to share their personal data with the network service. Although their privacy policies are strongly defined and analyzed, users do not know how their information is managed by network providers and they use Facebook, Twitter, Instagram, etc. to benefit from their services. provide their information to service providers [11]. Due to the nature of information sharing and the need to process big data, including web data sources, privacy protection becomes more difficult [6]. Security control protocols may also be missing in this law. For all these reasons, users should be aware that their personal data may be exposed to malicious attacks while shopping online, browsing online sites, and during any transaction on the internet.

Network designers must protect network traffic from intruders such as attackers and opportunistic malware. For example, when the user connects to a free Wi-Fi, hackers may be listening to that data connection line and the user’s personal data is in danger.

Application security is the precautions to be taken to avoid exposure to malicious attacks while developing applications and to prevent theft of important data in the application. In order to develop a secure application; During the planning, design, implementation, and testing phases, security studies should be carried out completely. Finally, after the application is released, the process should be followed, new security vulnerabilities should be detected, and updates should be made.

Server-side inspection processes have been developed to successfully test installed applications and detect malware. Administrators should implement well-defined security policies. For example, iPhone applications can only be downloaded from the App Store. In other words, applications that comply with Apple’s security policies can be installed on iPhone devices.

5 Conclusion

While the number of smartphone usage continues to increase rapidly, especially the mobile usage areas have expanded with the impact of the COVID-19 epidemic in recent years. Malware and threats are rapidly diversifying, renewing, and improving themselves. Mobile security is not only directly related to the operating system and used device but also related with communication over the internet, data encryption, data summarization, and users’ privacy awareness.

In this paper, we first touched on malware and attack types, and security vulnerabilities. Then, current threat detection and prevention methods were deeply analyzed. Finally, we reviewed the ongoing threat detection and prevention efforts of developers in the mobile security space that were reported in recent mobile security threat reports.

While there are new methods in security studies related to mobile devices, malicious attackers also develop new methods in malware and threats. Security efforts in personal and corporate mobile devices need to be strengthened to protect against malicious attacks that continue with unpredictable growth.

Signature-based detection studies (cryptographic hash or package name) are used very often, but they are not successful enough. Malware and threats are constantly evolving and changing themselves to avoid detection by current security tests. Therefore, more machine learning algorithms should be used for detecting fake mobile applications and network monitoring in a timely manner. Testing for malware and threats should be performed dynamically using deep learning algorithms. For these tests to yield successful results, security companies must be more generous in making their malware datasets public. Otherwise, malware detection and recognition studies using smaller data samples may be insufficient.

Despite the increase in mobile malware and threats, corporate mobile usage has become widespread in recent years, with bring-your-own-device (BYOD) policies. This spread accelerated as people started working from home due to the COVID-19 outbreak. This creates new opportunities for malware developers. Organizations that must employ a mobile-friendly workforce need to increase the necessary cyber security measures both to protect the personal data security of the employees and to protect the information belonging to the sensitive organization.

In the light of the current studies, and the mobile security reports, the future of mobile security can be focused on these sub-research areas and topics:

  1. a)

    New signature-based techniques powered with machine learning-based techniques can be proposed,

  2. b)

    New machine learning-based techniques that especially work with imbalanced network traffic datasets can be produced,

  3. c)

    New classification algorithms can be presented that detect the malicious flow,

  4. d)

    The storage of the sensitive user data can be secured with new techniques,

  5. e)

    The Android market rules can be redesigned similarly to iOS market rules.