# A Lightweight Multi-Source Fast Android Malware Detection Model
## 3 A Lightweight Multi-Source Fast Android Malware Detection Model
### Base Model for Identifying Android Malware by Dex Header  
Since the Dex files of different Android applications have different sizes, and some Dex files have large sizes, scanning the entire dex file for all data can be quite time-consuming. A malware detection tool proposed by [PERSON] et al. for extracting features from PEs completed a single scan of all features in the dataset with a detection rate of over 99% [27]; however, they scanned the entire contents of the PE file, which took nearly an hour. Therefore, we elicit an approach to distinguish malicious and benign applications based only on the header information. Dex headers hold meta-information about a dex file, such as the size and offset information of each index area within the dex, which describes the summary structure of a dex file. In this paper,We analyzed and compared the values of some fields in the dex file header of the dataset malware and benign software samples and presented them by data visualization as shown in Figure 4, we found that malware and benign software have large differences in the distribution of the values of these fields, so we considered that using header information for Android malware classification is effective, while we confirmed this in our experiments. The above analysis shows significant differences between malware and benign software in the values of several fields in the Dex header. Thus we extract malware features based on the Dex header to discriminate the base model of malware. The Dex file header parser reads the basic section of the Dex header based on the definition of the dex structure in dalvik/libdex/DexFile.h in the Android source code. First, it determines whether it is a valid dex file by checking the Dex magic number field, which the first 8 bytes of the dex file, represented by eight 1-byte unsigned numbers. Its value is a combination of the dex string and the file version number combination, such as \"64 65 78 0A 30 33 35 00\", using the ASCII table for conversion to get \"dex\
\035\
0\", where the version number is used for the system to identify and parse different versions of the format of The version number is used to provide support for the system to recognize and parse Dex files with different version formats. After judging the legitimate dex file by checking, parse it according to the definition of DexHeader structure in DexFile.h, and get all the fields in the structure. The size and offset information of the parsed file signature, link segment, mapping item, type identifier, string identifier, prototype identifier, etc., are encoded in hexadecimal and normalized to obtain a one-dimensional gray matrix is the feature extracted from the dex header. Base Model for Identifying Android Malware by Power Spectral Density of Structural Entropy of Dex File  
Entropy measures the randomness or uncertainty of a variable. [PERSON] relates information to uncertainty; if one can measure the uncertainty of a thing, then one can also measure the amount of information in a given piece of information. Shannon entropy formula is expressed as Equation (1):  
\[H(X)=-\sum_{i=1}^{n}P(x_{i})\log P(x_{i}) \tag{1}\]  
where \(H(X)\) is the entropy of the variable \(X\), \(\sum\) defines the sum of the possible values \(x_{i}\) of the variable \(X\), and \(P(x_{i})\) is the probability of occurrence of the possible outcomes \(x_{i}\) of the variable \(X\), where \(i\) represents the number of outcomes, varying between 1 and \(n\). Malware of the same type usually has similar malicious code segments, which are compiled and eventually reflected in the binary data stream of the Dex file. Therefore, these malicious code fluctuations will also react to the entropy sequence obtained from the binary data stream chunking calculation. The binary stream of the classes.dex file is subjected to the information measure to obtain the entropy sequence. Many scholars have detected the malware based on the entropy features. [PERSON] et al.