# A Risk Assessment Framework for Mobile Apps in Mobile Cloud Computing Environments
## 2 Materials and Methods
### Study Sample and Datasets
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**ID** & **Name** & **Type** & **Benign Apps (in \%)** & **Malicious Apps (in \%)** \\ \hline P1 & WRITE EXTERNAL STORAGE & Dangerous & 63.61 & 91.47 \\ P2 & READ PHONE STATE & Dangerous & 25.84 & 96.52 \\ P3 & ACCESS COARSE LOCATION & Dangerous & 24.95 & 68.2 \\ P4 & ACCESS FINE LOCATION & Dangerous & 26.72 & 59.53 \\ P5 & GET TASK & Dangerous & 6.49 & 50.17 \\ P6 & READ EXTERNAL STORAGE & Dangerous & 30.58 & 33.42 \\ P7 & SYSTEM ALERT WINDOW & Dangerous & 7.78 & 29.47 \\ P8 & READ LOGS & Dangerous & 1.85 & 30.57 \\ P9 & MOUNT UNMOUNT FILESYSTEMS & Dangerous & 1.52 & 30.57 \\ P10 & CAMERA & Dangerous & 19.34 & 19.7 \\ P11 & RECORD AUDIO & Dangerous & 8.31 & 20.18 \\ P12 & GET ACCOUNTS & Dangerous & 19.41 & 14.14 \\ P13 & CALL PHONE & Dangerous & 7.62 & 18.81 \\ P14 & WRITE SETTINGS & Dangerous & 5.7 & 16.5 \\ P15 & SEND SMS & Dangerous & 2.08 & 16.5 \\ P16 & INTERNET & Normal & 98.8 & 99.89 \\ P17 & ACCESS NETWORK STATE & Normal & 93.09 & 97.88 \\ P18 & ACCESS WIFI STATE & Normal & 35.59 & 83.36 \\ P19 & WAKE LOCK & Normal & 58.29 & 45.16 \\ P20 & VIBRATE & Normal & 34.04 & 50.92 \\ P21 & RECEIVE BOOT COMPLETED & Normal & 23.3 & 38.22 \\ P22 & CHANGE WIFI STATE & Normal & 4.92 & 31.42 \\  & ACCESS LOCATION EXTRA & Normal & 1 & 22.65 \\  & COMMANDS & & 1 & 17.63 \\ P24 & RESTART PACKAGES & Normal & 1 & 17.63 \\ P25 & MODIFY AUDIO SETTINGS & Normal & 4.73 & 13.32 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Permissions used by the apps in the study sample. significant compromise. In contrast, only a small number of the benign apps in the study sample requested these two permissions (6.49% and 25.84%, respectively). Similarly, another five permissions (ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION, READ_LOGS, MOUNT_UNMOUNT FILESYSTEMS, SYSTEM_ALERT_WINDOW) were used more frequently by the malicious apps rather than by the benign apps in the sample. In addition, both benign and malicious apps requested the dangerous permissions, WRITE_EXTERNAL_STORAGE and READ_EXTERNAL_STORAGE, with malicious apps still exhibiting more frequent use (91.47% vs. 63.61% and 33.42% vs. 30.58%, respectively). The dangerous permission request patterns that emerged indicated that app permissions may be used to make inferences about the potential of an app being malicious. With respect to the usage pattern of intents in the sample, the two most often declared intents were Action_MAIN and Category_LAUNCHER, which were used both by benign and malicious apps with similar frequencies. However, there were some intents that showed relatively higher use by malicious apps compared to benign ones; for example, Action_USER_PRESENT (to know whether the MD is in use or idle) and Action_PACKAGE_ADDED (to add code to resident apps or to install a new app). While the percentage of malicious apps using these intents was not high in itself, their usage patterns provide additional insights into the app's potential riskiness if considered in conjunction with the respective permission usage patterns. Each of the study datasets was divided into two parts: 20% for testing and 80% for training and validation. The test datasets contained permissions and/or intents from 5661 apps (1995 benign and 3666 malicious apps). The training and validation sets contained permissions and/or intents from 22,645 apps. ML modeling was carried out using the Python programming language. The computer hardware included an Intel (R) Core (TM) i7-8700 CPU @3.20 GHz, 16 GB RAM, and a 500 GB hard disk drive.