# DroidPortrait: Android Malware Portrait Construction Based on Multidimensional Behavior Analysis
## 3 The Overall, Design of DroidPortrait
### Behavioral Model Construction
#### 3.1.3 Behavioral Characteristic Selection  
After behavioral characteristic extraction and transformation, we retrieve more than 50,000 characteristics from an Android app. Such a large number of characteristics include many common characteristics used in both Android benign apps and malware, which cannot depict Android malware uniquely. Moreover, redundant and irrelevant behavioral characteristic would cause extensive computation resources during model construction and make detection accuracy decline. To address these problems, we plan to select intrinsic behavioral characteristics from the extracted characteristics. Because of these behavioral characteristics that consist of static and dynamic characteristic, their value types are different. Therefore, we propose two kinds of characteristic selection approaches for each kind of characteristic.  
**Static characteristic selection.** Given that the value of the static behavioral characteristic is discrete, not every app contain all of the behavioral characteristic. From previous works, there are several well-known feature selection approaches have been proposed, such as chi-squared [31] and information gain [32]. However, [PERSON] et al. [33] illustrated that both selection approaches have distribution bias and long-tail effect limitations. To address these limitations, we use the feature selection approach, as illustrated in [33].  
The characteristic selection approach assumes that \(T_{m}\) and \(T_{b}\) are the number of malware \(m\) and benign apps \(b\), and then we examine two conditions:  
\[\begin{array}{l}\mathit{Cond.1}:r_{c}\geq\alpha_{c}\eta_{c}=\frac{N_{c}}{(N _{m}+N_{b})},c\in\{m,b\}\\ \mathit{Cond.2}:\frac{N_{c}}{T_{c}}\geq\beta_{c}?\end{array}\]  
where \(N_{m}\) is the number of malware that contains a specific feature, \(N_{b}\) is the number of benign apps that contain particular features, \(r_{c}\) means the ratio of a specific feature contains by benign app or malware. \(N_{c}\) means a certain feature contains in benign app and malware, \(\alpha\) and \(\beta\) are threshold, \(0.5\leq\alpha\leq 1\) and \(0\leq\beta\leq 1\), respectively. Thus, \(\mathit{Cond.}\) 1 implies that a feature is used more frequently in malware than benign apps, while \(\mathit{Cond.}\) 2 means that the occurrence times of a feature in all malware exceeds the threshold \(\beta_{m}\). A feature should be selected as a typical feature once it satisfies the two conditions. In this way, the typical features we collect are not only frequently used by malware, but also have a particular coverage in the feature dataset, Distribution Bias and Long Tail Effect are well solved. Since the detailed algorithm is discussed in [33], we do not go further with details.  
**Dynamic characteristic selection.** Dynamic characteristic includes network and system call behavioral characteristic. The value of both kinds of characteristics is of numeric type, and each app contains all behavioral characteristics on them. Therefore, we use a behavioral comparison approach to observe the difference between the Android benign app and malware. In previous research works [13], we extracted network traffic and system call behavioral characteristics and then compared the difference between the Android benign apps and malware. After behavioral characteristics comparison, we select 11 types of behavioral characteristics from network traffic and 15 types of behavioral characteristics from the system call, as shown in Table 2 the detailed information.