Runtime Detection Framework for Android Malware

Figure 4

Example of suffix tree generation/modification: dotted line edges denote failure transition, and solid line edges denote state transitions. Ukkonen’s algorithm is utilized to construct the suffix tree.