## 4 Materials and Methods
### Exploratory Factor Analysis  
Determining the correlation between permissions in complex data sets such as Android malware is challenging. A total of 12,267 malicious and 10,837 benign applications were used for our study. Exploratory factor analysis is a great simulation technique in reducing multivariate data dimensionality to identify minute factors that explain the underlying correlation between variables. This technique was applied in the research of [79] to analyze the dataset. We apply the equamax exploratory factor analysis rotation method to reduce the number of independent \(k\) factors based on their eigenvalues (see Figure 7) that could be obtained from many correlated permissions and to test for possible permission correlation using correlation methods (Pearson, Spearman, and Kendall correlation). Factor analysis technique enhances establishment of the best portion of permissions variables interrelationship among factors. Using [PERSON]'s approach [80], we extracted three factors by MSA extraction procedure. The factors in the structure matrix of the selected variables using the equamax rotation method (see Table 2) explain the correlation among the permission variables. Each of the factors (factor 1, factor 2, and factor 3) was represented by circles, and the permission variables selected were represented by boxes in the path diagram (see Figure 8). Figure 7: The Scree plot shows how much there is variance in the dataset by eigenvalues in the three factors. Figure 8 shows the cursors from the factors pointing to the permission variables signify how a factor loads on the permission variable. When there is a positive loading, the model represents it with green arrows; otherwise, red arrows. The dimension of the loading is determined by the size of the arrow. This means that when loading is high, the arrows become wider; when loading is low, the arrows become narrower. Ac \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Factor 1** & **Factor 2** & **Factor 3** \\ \hline WRITE\_SMS & \(0.972\) & \(0.077\) & \(-0.220\) \\ READ\_SMS & \(-0.252\) & \(0.967\) & \\ SEND\_SMS & \(0.934\) & \(-0.302\) & \(0.191\) \\ RECEIVE\_SMS & \(0.972\) & \(0.077\) & \(-0.220\) \\ RECEIVE\_WAP\_PUSH & \(-0.252\) & \(0.967\) & \\ CALL\_PHONE & \(0.934\) & \(-0.302\) & \(0.191\) \\ READ\_PHONE\_STATE & \(-0.252\) & \(0.967\) & \\ READ\_CALL\_LOG & \(0.934\) & \(-0.302\) & \(0.191\) \\ WRITE\_CALL\_LOG & \(0.972\) & \(0.077\) & \(-0.220\) \\ ADD\_VOICE\_MAIL & \(-0.252\) & \(0.967\) & \\ USE\_slip & \(0.934\) & \(-0.302\) & \(0.191\) \\ PROCESS\_OUTGOING\_CALLS & \(0.972\) & \(0.077\) & \(-0.220\) \\ GET\_ACCONTS & \(-0.252\) & \(0.967\) & \\ READ\_ACCONTS & \(0.934\) & \(-0.302\) & \(0.191\) \\ WRITE\_ACCONTS & \(0.972\) & \(0.077\) & \(-0.220\) \\ ACCESS\_CAMERA & \(-0.252\) & \(0.967\) & \\ READ\_EXTERNAL\_STORAGE & \(0.934\) & \(-0.302\) & \(0.191\) \\ WRITE\_EXTERNAL\_STORAGE & \(0.934\) & \(-0.302\) & \(0.191\) \\ READ\_CALENDAR & \(0.934\) & \(-0.302\) & \(0.191\) \\ ACCESS\_COARSE\_LOCATION & \(-0.252\) & \(0.967\) & \\ ACCESS\_FINE\_LOCATION & \(0.972\) & \(0.077\) & \(-0.220\) \\ RECOND\_AUDIO & \(0.934\) & \(-0.302\) & \(0.191\) \\ WRITE\_CALENDAR & \(0.972\) & \(0.077\) & \(-0.220\) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Structure Matrix of some selected variables using equamax rotation method. Figure 8: Exploratory analysis path diagram of the correlation factors and the permission variables. cordingly, record_audio, read_calendar, write_external_storage, read_external_storage, read_accounts, use_sip, read_call_log, call_phone, and send_sms are associated with factor 1. Read_sms, receive_wap_push, read_phone_state, add_voice_mail, get_accounts, access_camera, and access_coarse_location are associated with factor 2. Lastly, write_calender, access_fine_location, write_account, process_outgoing_calls, write_call_logs, receive_sms, and write_sms are associated with factor 3.