## 5 Experiment
### Example of Extraction Information  
It is not sufficient to rely solely on numerical scores to verify that the extracted behavioral information effectively describes the behavior of an application or correlates with the malware type. In addition to validating interpretations based on scores, we also want to demonstrate reliability by explaining the information extracted through static analysis. Test samples for demonstration are selected from various malware categories. Static analysis is performed based on the extracted information to demonstrate the relationship and validity of the extracted features compared to the application's behavior. We have experimented with many types of malware, but discuss just one typical example in the following section. SMS Malware--trojan.fakeinst/smsagent  
The sample has a popular threat label on VirusTotal as trojan.fakeinst/smsagent (sha2: 7f38675a778f8 aeee0d76d63903f67e06 fbdc49 de7310a7744466416c8d924 ce) and is a malicious mobile application that uses the SMS function to perform malicious actions. This malicious \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Malware Family** & **Drebin** & **LIME** & **XMal** & **Our Approach** \\ \hline FakeInstaller & 0.25 & 0.25 & 0.35 & 0.37 \\ DroidKungFu & 0.44 & 0.50 & 0.66 & 0.83 \\ Plankton & 0.50 & 0.57 & 0.80 & 0.60 \\ Opfake & 0.44 & 0.85 & 0.88 & 0.40 \\ Ginmaster & 0.75 & 0.75 & 0.92 & 0.83 \\ BaseBridge & 0.20 & 0.73 & 0.89 & 0.88 \\ Iconosys & 0.44 & 0.85 & 0.85 & 0.86 \\ Kwin & 0.44 & 0.75 & 0.93 & 0.88 \\ FakeDoc & 0.50 & 0.57 & 0.66 & 0.56 \\ Geinimi & 0.40 & 0.60 & 0.75 & 0.82 \\ Average & 0.43 & 0.64 & 0.76 & 0.70 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: _it\({}_{description}\)_ values of Drebin, LIME, XMal, and Our Proposed method. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature** & **Semantic** \\ \hline Ljava/net/URL; \textgreater{}openConnection & Access the Internet \\ Landroid/telephony/TelephonyManager; \textgreater{}getDeviceId & Collect device ID(IMEI) \\ Landroid/telephony/gsm/SmsManager; \textgreater{}sendDataMessage & Send SMS message \\ Ljava/lang/Runtime; \textgreater{}getRuntime & download components \\ android.permission.READ_SMS & Collect SMS \\ android.permission.RECEIVE\_BOOT\_COMPLETED & Activated by BOOT \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Example of a semantic that matches an API, permission key. Data from [9]. app belongs to the SMS malware family. It is classified as SMS malware by our ViT model. The short message service (SMS) malware sample uses the SMS service to exploit. The attacker uses a command and control (C&C) server to send attack commands. The attacker makes the device send an SMS, intercepts incoming or outgoing SMSs, and steals data. Since this sample has been detected as SMS malware, we start the process of extracting the names of the classes and methods used to determine maliciousness through our proposed method. We begin by creating a heatmap. **a. Make attention map. ** First, an attention map is generated, and high attention regions are selected. Figure 6a, shows the DEX of the malicious app converted to an image, Figure 6b shows the attention map for a DEX image generated by our proposed method, and Figure 6c shows the selected regions on the attention map. **b. Convert to dex offset. ** The Algorithm 2 is used to filter out the high attention regions of the attention map and convert them to dex offset values. When the converted dex offset values are plotted as an image, it looks like (c) in Figure 6. In the following Figure 7, the rectangles of the attention map correspond to sections of the DEX. **Figure 6. (a) DEX image of trojan.fakeinst/smsagent, (b) attention map, (c) an image representation of the DEX offset values of the highlighted regions of the DEX. **  
Figure 7. The rectangles on the attention map are the regions selected in step a. and indicate which DEX section the rectangle corresponds to. DEX sections are color-coded.