# Machine-Learning-Based Android Malware Family Classification Using Built-In and Custom Permissions
## 6 Related Work
\begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Study** & **Features** & **Classifiers** & **Metrics** & **Dataset** \\ \hline A3 CM [5] & Requested permissions, used permissions, API calls, network address & SVM, DT, DNN & Precision, recall, F1-score & DREBIN, AMD/ 4 capability types \\ \hline \multirow{2}{*}{[PERSON] et al. [54]} & Permissions, components, dynamic app interaction, etc. & Clustering algorithms & Adjusted Rand index, homogeneity, completeness, V-measure & 1.5 million apps \\ \hline \multirow{2}{*}{[PERSON] et al. [8]} & Requested permissions & SVM, DT(ID3), RF, NN, k-NN, bagging & Accuracy & StormDroid [9]/ 28 families \\ \hline \multirow{2}{*}{EC2 [53]} & Permissions, dynamic features (network, system information, etc.) & SVM, RF, DT, k-NN, LR, NB & Precision, recall, F1-score, AUC at macrolevel and microlevels & DREBIN, Koodous/ 4 families \\ \hline \multirow{2}{*}{DREBIN [23]} & Requested permissions, used permissions, API calls, network address, HW components, etc. & SVM & Accuracy, detection rate & DREBIN/ 20 families \\ \hline \multirow{2}{*}{[PERSON] et al. [16]} & Permissions, API calls, ICC attributes & SVM, DT, RF, k-NN, MLP & Precision, recall, F1-score, accuracy & Genome, DREBIN, AMD/ 32, 131, 71 families \\ \hline \multirow{2}{*}{DroidSieve [10]} & Permissions, API calls, code structure, invoked components & Extra Trees & Accuracy, F1-score & DREBIN / 108 families, PRAGuard/not specified \\ \hline \multirow{2}{*}{[PERSON] et al. [50]} & Built-in permissions, API calls, HW components & SVM & Accuracy & 11,643 apps from Anzhi/ 10 families \\ \hline \multirow{2}{*}{AndMFC [51]} & Requested permissions, API calls & SVM, DT, LR, k-NN, RF, AdaBoost, MLP, Majority voting & Macrolevel precision, recall, and F1-score, accuracy & AMD, DREBIN, UpDroid/ 71, 132, 20 families \\ \hline \multirow{2}{*}{[PERSON] et al. [52]} & Permissions, API calls, HW components, internost, network address, etc. & Genetic algorithm for feature selection & Not specified & DREBIN/ 179 families \\ \hline \multirow{2}{*}{Our study} & Requested permissions (built-in permissions + custom permissions) & ANN, DNN, RF, Extra Trees, AdaBoost, XGBoost, LightGBM & Precision, recall, and F1-score at macrolevel, accuracy, MCC & DREBIN/ 20 families \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of the studies on Android malware family classification/clustering using permissions. graph and calculated the similarity of malware samples using the weighted sum of feature similarities. Malware samples were clustered by the optimal weights based on social network analysis. They used accuracy as the evaluation metric. [PERSON] et al. (2018) explored an approach for Android malware detection and familial classification using a graph neural network and developed a prototype system called GDroid. The approach mapped both apps and Android APIs into a heterogeneous graph, which was fed into the graph convolutional network model, and utilized a node classification problem for malware classification. GDroid achieved an average accuracy of almost 97% in the malware familial classification on the datasets AMGP, DB, and AMD. They used the precision, recall, and F-measure for the evaluation metrics. [PERSON] et al. (2018) proposed a feature fusion method that used distinctive pretrained models (AlexNet and Inception-V3) for feature extraction. The method converted binary files of malware to grayscale images and built a multimodal representation of malicious code that could be used to classify the grayscale images. The features extracted from malware images were classified by some variants of SVM, KNN, decision tree, etc. They also performed data augmentation on malware images. Their method was evaluated on a Malimg malware image dataset, achieving an accuracy of 99.3%. They employed the recall, accuracy, AUC, and error rate for the evaluation metrics  
[PERSON] et al. (2018) proposed an Android malware classification approach, called DroidSieve.