tokens: True positives ( TP ) denote malicious apps correctly classified as malicious , false positives ( FP ) denote benign apps mistakenly classified as malicious , and false negatives ( FN ) denote malicious apps mistakenly classified as benign .