# A Lightweight Multi-Source Fast Android Malware Detection Model
## 3 A Lightweight Multi-Source Fast Android Malware Detection Model
### Base Model for Identifying Android Malware by Dex Header
[28] proposed a method for the detection of parasitic malware based on the entropy features and achieved good performance. [PERSON] et al. [29] extracted the entropy sequence of malicious documents and detected the malware based on the machine learning algorithms. Unlike previous studies, we use structural entropy for the detection against classes.dex files, and also because the size of the classes.dex file of different Android programs is inconsistent. The length of the received entropy sequence is also varying. So we use the power spectral density method to calculate the power spectral density of the entropy sequence to quickly obtain the fixed-length features for machine learning. Figure 4: Distribution of values in the header of malware and benign software files. The power spectral density of a signal (Power Spectral Density) describes the power present in a signal as a function of frequency per unit. The calculation methods of power spectrum mainly include the fast Fourier transform method, Welch method, multi-window method, maximum entropy method, etc. The first three belong to the periodogram method. Since the periodogram method is a method to estimate the finite length autocorrelation of the signal, it requires truncation or windowing of the signal sequence so that the estimated power spectrum is the convolution of the true spectrum of the signal sequence and the window spectrum, so its ability to produce accurate power spectrum estimates is limited [30], which is why we use the maximum entropy method to calculate the power spectral density \(P(f)\)[31], which is expressed as Equation (2):  
\[P(f)=\frac{P_{m}\triangle t}{|1+\sum_{k=0}^{m}\gamma_{m,k}exp(-i2\pi fk \triangle t)|^{2}} \tag{2}\]  
where \(P(m)\) is the output power of the filter at the fluctuation period of the \(m\)th order, \(\gamma_{m,k}\) is the filter coefficient when \(m=0,1,\ldots,M\), and \(M\) is the corresponding filter coefficient at the optimal filter order, and \(P_{m}\) and \(\gamma_{m,k}\) are obtained by solving the Yule-Walker equation through Burg method [32; 33]. We randomly selected a benign sample and a malware sample and calculated the structural entropy sequences of the binary streams of their Dex files and power spectral densities of the entropy sequences, which we abbreviate as MEM-PSD, as shown in Figure 5, from which we can learn that different lengths of structural entropy sequences can be calculated for a fixed-length power spectral density. We take the byte stream of classes.dex as a time series, divide the sequence with a block size of 256 bytes, and then construct a structural entr  
Figure 5: Distribution of structural entropy and MEM-PSD of benign software samples and malware samples. Algorithm 1. We compute the power spectral density of the structural entropy sequence to obtain a power spectral sequence of length 128 as a feature vector. This feature vector is used as input and the multilayer perceptron is used as a classifier to construct this base model. ```
Input: byte sequence \(S_{b}\), block size \(bs\) Output: structural entropy sequence \(S_{H}\)
1\(L_{sb}\) = Length of \(S_{b}\); \(Left\) = \(L_{sb}\) mod \(bs\); if\(Left\) < \(bs/2\)then
2 Truncate the end of \(S_{b}\) by the length \(Left\); elseif\(Left\) > \(bs/2\)then
3 Pad the end of \(S_{b}\) with an all-zero sequence of length \(bs-Left\);
4 end if
5\(X\) = Reshape \(S_{b}\) to a 2D matrix of size \((L_{sb}|256+1256)\);
6 Initialize a one-dimensional array \(S_{H}\);
7 forRow in first dimension of \(X\)do
8 Calculate the number of occurrences of each value in \(Row\) and assign the result to \(C\); \(P=C/bs\);
9 Filter out the elements of \(P\) equal to 0;
10\(H=ShannonEntropy(P)\);
11\(S_{H}\)=Append \(H\) to \(S_{H}\);
12
13 end for
```  
**Algorithm 1**Calculate the structural entropy sequences using Shannon entropy