# Machine-Learning-Based Android Malware Family Classification Using Built-In and Custom Permissions
## 6 Related Work
Their findings were that: (i) MLP slightly outperformed the four other classifiers by about 1-3% on the F1-score; (ii) API calls were more relevant features than permissions; (iii) the MLP-based transferability across different datasets was explored. [PERSON] et al. [53] proposed EC2, which combines malware classification and clustering. They employed RF; SVM, naive Bayes (NB), LR, k-NN, and DT for supervised classification and MeanShift, K-means, affinity, and DBSCAN for unsupervised clustering. They used 190 static features including permissions and 2048 dynamic features including cryptographic usage, network usage, and file I/O. They conducted experiments on the DREBIN and Koodous dataset. [PERSON] et al. [54] introduced a semisupervised scalable framework with the goal of identifying similar apps and generating malware family signatures. The framework mined massive Android apps to automatically cluster malicious apps into families, while reducing the false positive rate. The framework extracted many features through static and dynamic analysis. Static features were obtained from the manifest file (permissions, filters, components) and the bytecode analysis. Dynamic features represented the app interaction with the operating system at the file system and networking module. Table 4 shows the comparison of the studies on classifying or clustering Android malware families using permission information. Among the studies, [PERSON] et al. [54] presented a framework that clusters apps into families and identifies them using formal  
rules. To the best of our knowledge, our study is the first to adopt _custom permissions_ and the _MCC_ for Android malware classification. Moreover, we achieved high performance only using permissions and validated the effectiveness of custom permissions by applying the _p_-value approach to hypothesis testing. To classify Android malware samples into their corresponding families, some existing studies utilized other features than permissions. [PERSON] et al. [37] leveraged obfuscation-resilient features such as API usage, reflection-related information, and native code features. They compared their method with the other existing methods and demonstrated that their method was resilient to obfuscation. They used accuracy for evaluating the proposed classification. [PERSON] et al. [4] constructed sensitive API-call-based frequent subgraphs that represented malicious behavior common to malware samples belonging to a family. They also developed a system called FalDroid to efficiently classify large-scale malware samples. The system offered useful knowledge for detecting and investigating Android malware. They evaluated the system in terms of precision, recall, F1-score, ROC, and accuracy. [PERSON] and [PERSON] [15] proposed Stochastic Hashed Weighted Lempel-Ziv (SHWeL), which is an extension of the Lempel-Ziv Jaccard Distance (LZJD). Using the SHWeL vectors, the authors could make efficient algorithms for training and inference. The SHWeL approach was helpful to solve the class imbalance problem. It worked well with the LR classifier and improved balanced accuracy compared to the LZJD and SMOTE. [PERSON] et al. [55] extracted several features though static and dynamic analysis. They used the permissions, file name, and activity name as the static features and the API call sequence as the dynamic features. They represented the features using a social network