The rise in popularity of the Android platform has resulted in an explosion\nof malware threats targeting it. As both Android malware and the operating\nsystem itself constantly evolve, it is very challenging to design robust\nmalware mitigation techniques that can operate for long periods of time without\nthe need for modifications or costly re-training. In this paper, we present\nMaMaDroid, an Android malware detection system that relies on app behavior.\nMaMaDroid builds a behavioral model, in the form of a Markov chain, from the\nsequence of abstracted API calls performed by an app, and uses it to extract\nfeatures and perform classification. By abstracting calls to their packages or\nfamilies, MaMaDroid maintains resilience to API changes and keeps the feature\nset size manageable. We evaluate its accuracy on a dataset of 8.5K benign and\n35.5K malicious apps collected over a period of six years, showing that it not\nonly effectively detects malware (with up to 99% F-measure), but also that the\nmodel built by the system keeps its detection capabilities for long periods of\ntime (on average, 86% and 75% F-measure, respectively, one and two years after\ntraining). Finally, we compare against DroidAPIMiner, a state-of-the-art system\nthat relies on the frequency of API calls performed by apps, showing that\nMaMaDroid significantly outperforms it.\n