## 3 Chidroid Architecture
### Android Permission Retrieval  
Overall, the config.toml file defines the behaviour and settings of the data collection inputs. Here, the shell commands that initiate the Package Manager (pm command) and the corresponding permission monitoring and retrieval are presented. The \"pm\" command (Listing 6) is a tool provided by the Android operating system for managing installed packages. The Package Manager is an Android system internal application that performs actions and queries on applications and software packages installed on an Android device. The command pm is a Command-Line Interface (CLI) API to interact with Package Manager to enumerate or manage the installed packages on the device. It can also enable various actions on those packages. For example, the command can retrieve the full list of the software packages installed on the device, displaying the names of the software packages, along with the version number, process id, and other details for each of the installed software packages. Internal filtering allows this command to display specific packages, such as associated files, enabled/disabled packages, system packages, third-party packages, and installler packages. For example, the -u flag can display a list of uninstalled packages. In summary, the command can be used to retrieve the lifecycle of installed software packages. ```
1{script.permissions}
2 Cmd='pmlistpackages-u-3
3|cut-c9-
4|whilereadline;doecho$line;appopsget$line
5|sed's/Uidmode://';done\"
6 Rules=[\"eventbreak.eventperm\",\"rex.extract\",\"zip.perms\",\"str.j13\",\"<for.join13\",\"zip.perms_time\",\"str.j15\",\"for.join15\",\"zip.<perms_duration\",\"fields.remove_temp\"]
7 Index=\"android_permissions\"
8 Outputs=[\"Al4 HELATHESC\"]The \"list packages\" subcommand lists all installed packages on the device, including both user-installed and system packages. The output will include uninstalled packages using the \"-u\" option, and the \"-3\" option will include third-party packages. The \"pm list packages\" output is passed to the \"cut\" command, which extracts the package names from the output. Using a \"while\" loop, the script reads the package names one by one and runs the \"appops\" command to retrieve application permission data for each package. The \"appops\" command is another tool provided by Android for managing application permissions, and the \"get\" sub-command retrieves the application permission data for a specific package. The output from the \"appops get\" command is piped to the \"sed\" command, which removes the \"Uid mode:\" prefix from each line of output. ### System Metrics

In addition to the aforementioned logs, Chidroid can directly retrieve system metrics from the Android device, including information about battery life, virtual memory usage, CPU usage, and network connections. These system metrics are important to monitor the performance and overall state of the device. Tracking these metrics makes it possible to identify software packages that consume a large number of system resources, such as CPU or memory. This is particularly important in IoMT and healthcare services, where the high usage of resources can lead to risky and critical safety conditions for patients. As a result, Chidroid can help identify and mitigate the potential security risks posed by software packages that consume a large number of system resources. This can help ensure the safety and security of patients and their data in the IoMT and healthcare domains if there is a malfunction, critical system, or security issue. Chidroid retrieves various metrics, including CPU usage, virtual memory, disk counters, load average, network counters, connections, and running processes, on an Android device using the following stanza (Listing 7). Within this stanza, the index name, job frequency, and endpoint for log distribution are defined for each metric. The source-type settings are described in the following subsections (Sections 3.3 and 3.8).