# Using Machine Learning to Detect Vault (Anti-Forensic) Apps
## 3 Method  
An Android application contains a manifest file (in XML format) which presents essential information about an application to the Android system, including permissions. We used tools within the Androguard 4.1.2 (a Linux-based tool specifically designed for reverse engineering APK files) package, specifically \"androaxml.py\", to extract the Android manifest XML file of a given application and \"androcg.py\" to extract the call graph of the same applications. The apps were label manually. We started with a list of vault applications as classified by [PERSON] and Karabyik. Further APK files were sourced from websites that claimed to hold vault apps (www.apkpure.com, www.apkmonk.com, www.apkknow.com, accessed on 13 August 2024) and the Play Store. The vault apps were exercised manually either in \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Source** & **Technique** & **Sample/Dataset** & **Machine Learning** & **Model Quality** \\ \hline
[2] & Deobfuscation via reverse engineering & Vault apps & No & Not Applicable \\ \hline
[3] & Google’s Play Protect service & Android malware & No & Not Applicable \\ \hline [PERSON] [16] & XGBost classifier & Android malware & Yes & Supervised \\ \hline
[5] & Random Forest & Android malware & Yes & Supervised \\ \hline [PERSON] [2] & SVM & iOS malware & Yes & Supervised \\ \hline [PERSON] [5] & SVM & Vault apps & Yes & Supervised \\ \hline [PERSON] [11] & Random Forest (and others) & Generic malware & Yes & Supervised \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of related work. an emulator (Android Studio) or on an Android phone to test whether they contained the claimed vault functionality. If so, they were label as vault apps. If not, they were discarded. Non-vault apps were sourced from the Play Store. We assumed that well-known apps (e.g., Facebook) did not contain any vault (hidden) functionality. As noted by [PERSON] et al. [5], permissions are often used as features for detection in Android apps. To attempt to identify potential vault activities, various tags were extracted, namely: Uses-permission, Activities, Services, Metadata, Action, Receiver, and Provider. Each of these tags, particularly those related to permissions, are useful for detection purposes. Uses-permission: This specifies a permission that a user must grant for correct app operation. This can be either when the app is installed or while the app runs, depending on the Android version [20]. The permissions often relate to devices or files that could be accessed by a vault app, such as the camera or the contacts file. The format is \"android.permission.<DEVICE_NAME | FILE_NAME>\", an example being \"android.permission. CAMERA\". Activities: This declares an activity (actually, an Activity subclass) that implements part of an app's user interface [20]. An activity can be launched as the embedded child of another activity, which has implications for vault apps. As noted by [PERSON] et al. [3], vault apps often employ decoy screens designed to hide activities. Services: Service subclasses run background tasks, which can potentially be executed before a user unlocks a device, as one of the application's components. Unlike activities, services do not need a user interface [20], which provides a certain utility for vault apps. Meta-data: This tag refers to a configurable name-value pair for any item of additional data that can be passed to a parent component (such as an activity or service) [20]. A vault app could use metadata to reference elements of custom data structures (although such references can also be used by non-vault apps to perform legitimate functions). Action: This adds one or more actions to an intent filter. An intent is a messaging object used to request an action from another app component [20]. Although actions are a common tag, it might be possible to detect vault activities characterized by the declaration of custom messages for actions. Receiver: This declares a broadcast receiver as an app component.