# GA-StackingMD: Android Malware Detection Method Based on Genetic Algorithm Optimized Stacking
## 2 Related Work
### Features of Android Malware Detection  
The features of Android malware are extracted by static methods or dynamic methods, and the extracted different types of features can reflect the application software from different aspects. Thus these features are used to distinguish malware and normal applications. The feature categories in this work include Permissions, API calls, Dalvik opcodes, Intent, and Hardware. For example, [PERSON] et al. [12] detected Android malware by applying four machine learning classifier algorithms, namely, Naive Bayes, Support Vector Machine, Decision Tree, and Random Forest. After analysis and comparison, it was found that Random Forest had the highest accuracy. [PERSON] et al. [13] combined C-means, Random Forest, and Local Outlier Factor proposed a malware detection model using machine learning technology for malware detection, summarized some work on using different machine learning methods to solve malware detection problems, and applied different machine learning algorithms to measure performance in the proposed framework. Android provides a permission mechanism for developers to protect user privacy and system security. If an application needs to access or execute operations on specific resources, the developers have to request the corresponding permissions. In addition to 206 official permissions, developers also can customize permissions according to their demands and share resources with other applications. The AndroidManifest.xml file preserves permission-related information, such as security permissions that control access to specific components. [PERSON] et al. [14] applied multilevel permissions to detect Android malware and achieved satisfactory performance. API calls are pre-defined functions in programs that meet functional requirements and operational conventions. They are abstractions of application behaviors and object actions, and provide data sharing for various components. [PERSON] and [PERSON] [15] pointed out that the frequency and sequence of dangerous API calls of malware are obviously different from those of normal applications. The repetition frequency of some sensitive API is higher in malware than in benign ones. API calls are also widely used in malware detection [16]. Considering the high dimension of API calls, we choose \"Restricted API\" and \"SuspiciousAPI\" as classification features. \"Restricted API\" is protected by permissions, and \"Suspicious API\" refers to the suspicious ones marked by the expert, such as encryption functions, and sending HTTP request functions. Android translates Java source code into opcodes when executed on DVM (Dalvik Virtual Machine) at runtime, which is called Dalvik opcodes. After segmentation by N-gram, they are usually used in malware detection as the lowest-level features. [PERSON] et al. [17] applied Dalvik opcodes as classification features obtained by reverse engineering, and [PERSON] et al. [18] used Dalvik opcodes graph to detect Android malware. [PERSON] et al. [19] used opcode as the classification feature, and used four different feature subsets to analyze and compare the RF and the deep neural network. It was found that the precision of the classical RF classifier was better than that of the DNN regardless of the feature input. The Intent is a messaging object which requests operations from other components. The basic usages include starting activities and services and delivering broadcasts. [PERSON] et al. [20] pointed out that Intent features contain rich information which reflects the difference between malware and normal applications. They also demonstrated that Intent should be combined with other features to achieve better detection results. When an Android application runs on a terminal, it depends on the device's hardware, such as Bluetooth, network, and position coordination. If certain hardware is missing, the application which needs this hardware will not work properly.