## 3 Reputation Model
### Collecting Applications and Selecting Reviews  
In this phase, we gather applications from Google Play based on reviews which point out security concerns and other criteria which can influence reputation of the application. These criteria include user ratings, number of users who downloaded the application and the number of reviews made by the customers. The process of extraction of applications and reviews is supported by the tool Google Play scraper [52] which is very flexible according to expected results and its ability to consider different languages. This tool also enables to filter reviews based on key terms, an important characteristic since we deal with security aspects. Reviews are filtered as follows. First, we exploit Appbot [53] to identify applications which show critical words from their reviews. Figure 2 shows an example of the app Instagram which has critical words such as Bug, Error, Crash. Appbot takes as input  
Figure 1: Research design.  
sensitive applications that are expected to manipulate confidential information such as e-banking and messaging apps as well as app susceptible to prevent confidential data leaks such as antivirus. Once those applications are provided to Appbot, it gives for each app a list of critical words from the whole reviews of that application. We therefore select applications having reviews with critical words to perform deeper analyses. An analysis concerns extracting only reviews related to security aspects. Our method interchangeably translates keywords in French and English meaning that we consider both versions of the same keywords. The compilation of keywords is guided based on definitions of the main security services: confidentiality, integrity, availability and authentication. We refer to definitions of such services specifically in mobile environments [54]. Appendix A presents such keywords classified by security service with descriptions given considering the attacker side. For instance, concerning confidentiality the keyword \"sniffing\" is the art to passively observe information transmitted in the system. In the side of attacker, the one performing this action is not authorized to do that and tries to escalate privileges to capture information. Once we extract reviews of applications, some tools are used to mine keywords in reviews. The objective of mining is to confirm the effective presence of keywords in the reviews. We used two Search Engine Optimization (SEO) based tools, Alyze [55] and Keywordtool [56], to extract possible keywords from a review taken as input, associated with information such as number of occurrence and weight associated to each term of the review. They are of importance because it tells us whether our keyword appears or not. Even if it is associated with weight of 1, we consider the term as crucial to security aspect taken as a whole. Then we use Appbot, which is helpful since it deals with all the application's reviews and refreshes automatically with added or deleted reviews. It provides the frequency of apparition of a keyword within application reviews. This information helps to confirm whether a keyword is relevant to consider. All the keywords have been found relevant to use in the proposed model. Figure 2 shows an example of the search.  
Appendix A depicts 10 reviews (in the original and translated forms) concerning security flaws made on the Instagram application. This example is exploited further on to illustrate the methodology steps.  
Figure 2: Excerpt of critical words of the Instagram application.