# DroidPortrait: Android Malware Portrait Construction Based on Multidimensional Behavior Analysis
## 1 Introduction  
According to the statistical report released by IDC, the Android platform's market share first breaks through 80% in the smartphone market in Q3/2019[1]. There are almost three million applications (or apps) that can be downloaded from the official Android market, Google Play and more than 84 billion downloads to date[2]. The popularity of Android platform attracts many cyber-criminals to attack this platform by designing various Android malware that could launch several types of malicious activities, such as stealing sensitive information, controlling audio hardware to record user's conversation with others, obtaining the real-time geolocation of user and sharing it with others and others. These malicious behaviors impose threats to the platform as well as user privacy, permitting maliciousAndroid applications to launch various types of cyberattacks. Moreover, certain malware even has a large number of variants, which makes it very hard to detect all of them. In order to cope with the increasing security concerns caused by Android malware, there have been many research efforts to develop Android malware analysis and detection approaches [1; 2; 3; 4; 5; 6; 7; 8; 9; 10; 11]. For example, in recent research works such as SIGPID [1], DroidAPIMiner [2], APK Auditor [3], Drebin [4], the researchers first extract static features from Android applications, including permissions, API calls and others, so then apply them to various machine learning algorithms as feature vectors to identify Android malware. However, these static-based solutions cannot identify malware with code obfuscation. In addition, they generally assume that some behaviors occur more frequently than they would be in practice, which generally causes a considerable number of false positives. To address these limitations, some researchers propose to rely on dynamic app characteristics to capture run-time execution context and apply them to classification algorithms for Android malware detection [12; 13; 14]. For example, TaintDroid [12] identifies some privacy information sources by conducting a dynamic tainting analysis. In [13], the authors propose to capture HTTP traffic during an Android app's execution to detect Android malware. The main issues with these dynamic-based approaches are in the following two aspects: (1) they have to modify Android apps when they get updated [14] and (2) They require sufficient input suites to sufficiently exercise execution paths. In summary, both static and dynamic-based approaches only focus on one aspect of Android malware behaviors that cannot depict Android malware behaviors in a comprehensive and precise manner. In this study, we propose a new malware detection approach for Android system named DroidPortrait, which first extracts both static and dynamic behaviors from Android applications (or apps), then utilizes data portrait techniques to build multi-dimensional behavioral portrait for Android malware and finally uses the behavioral portrait to identify malware. The DroidPortrait primarily aims at accurately depicting behaviors of Android malware, and then detecting them efficiently and precisely. As the first step, both static and dynamic behavioral features are extracted from numerous Android apps. Several dimensions of features are then defined to depict Android malware. Second, we define a behavioral tag which generalizes meta-data of the behavioral characteristic of Android malware and design a behavioral tag for Android malware based on the tag extraction, definition and identification. Third, we analyze the correlation among these behavioral tags to build a behavioral portrait of Android malware. Last, we design a random forest-based algorithm, which uses a behavioral portrait for Android malware detection. The results of extensive experimentation performed to show that the proposed approach depicts Android malware behavior comprehensively and accurately--and can achieve 0.971 in terms of detection accuracy, 0.986 for precision, 0.97 for recall and 0.973 in terms of F1-measure.