## 3 Chidroid Architecture
### Android Permission Retrieval
```
1[metrics.all]
2 Metrics=[
3\"cpu\",#Cpu time consumed
4\"cpuinfo\",#Cpu version,andspec
5\"virtualmem\",#Memory used/free
6\"disk\",#DISI IO counters
7\"loadavg\",#CPU load average 1,5,15m
8\"net\",#Net IO Counters by interface
9\"connections\",
10\"process\",
11]
12 Cron=\"10*+*+*\"
13 Index=\"android_metrics\"
14 Outputs=[\"AI4 HEALTHESC\"]
```
**Listing 7** Retrieve device metrics. The stanza \"[metrics.all]\" specifies the settings for the \"metrics\" rule type and creates a new internal instance associated with the name \"all\". The \"Metrics\" property specifies the list of counters to be collected. In the example above (Listing 7), the rule set will collect metrics for CPU time consumed, CPU version and specification, memory usage, disk IO counters, CPU load average, network IO counters, network connections, and processes. The \"Cron\" property specifies the schedule at which the metrics will be collected. Metrics will be collected every minute (0*****). The \"Index\" suggests the target database name where metrics should be stored. Log collectors have final control and can override this definition. The \"Outputs\" option specifies the next hop the collected metrics will be sent. Here, the metrics will be sent to the \"AI4 HEALTHSEC\" as the configuration output (see Section 3, Listing 3). ### Log Distribution for Analysis--Regex and Log Sourcedypes

Regular expressions are a powerful technique for matching and manipulating text and are widely used in various fields of study and industry. Regular expressions can be employed in log sources to search and filter data for specific patterns or messages. A regular expression is a string of characters that defines a pattern to be matched in a text string. These patterns are specified using a special syntax, which allows for the matching of a wide range of patterns in text. For example, regular expressions can be used to match a specific word or phrase in a log message or to identify a specific pattern of characters in a URL. To search for a specific pattern in a log message using a regular expression, the pattern can be defined using the regular expression syntax and then employed with a tool or program such as Chidroid, which has built-in support for regular expressions. The tool or program will highlight or indicate the matching text in the log data if the pattern is found. Chidroid also has the capability of utilising named captures, a feature of regular expressions, which allows for the capturing of text matched by the regular expression and the ability to reuse it within the same pattern or in a substitution. This feature allows for greater flexibility and precision in analysing and manipulating log data. Each capture group in the example below (Listing 8) is defined using the following syntax: \"(?P<name>pattern)\", where \"name\" is the name of the capture group and \"pattern\" is the regex pattern that defines the contents of the group. The regex pattern in the example has five named capturing groups: \"timestamp\", \"pid\", \"opid\", \"type\", \"AppName\", and \"Message\". The \"timestamp\" capturing group matches a timestamp in the format \"MM-DD hh:mm:ss.SSS\". The \"pid\" and \"opid\" capturing groups match a string of digits representing a process ID and operation ID, respectively. The \"type\" capture group matches a single word character representing the type of the log message. The \"AppName\" capture group matches a string of characters representing the name of the application that generated the log message up to the first colon character. The \"Message\" capture group matches the remaining characters in the log message after the application name. ```
1[rex.logcat]
2 Patterns=['(?P<timestamp>\d\d\d\d\d\d\d:\d\d\d:\d\d\d\d\d\d\d)\s+(?P<pid \d>\d+)\s+(?P<opid>\d+)\s+(?P<opid>\d+)\s+(?P<type>\w)\s+(?P<AppName>[^:]+)\s+(?P<Message>.