# Using Machine Learning to Detect Vault (Anti-Forensic) Apps
## 3 Method
Broadcast receivers enable applications to receive intents (see Action above) that are broadcast by the system or by other applications, even when other components of the app are not running [20] (which could assist in hiding vault activity). Similar to Services, a receiver can run before a user unlocks a device. Provider: A content provider supplies structured access to data managed by an app [20]. It can contain an intent filter (see Action above). As with receivers and services, a provider can run before a user unlocks a device. Further, a provider could be made available to other applications (although again, such functionality can also be used by legitimate apps). We obtained 521 vault and 519 non-vault apps from various web sites and the Google Play Store. The list of application names and dataset is available on request. The vault apps were tested for the presence of malware using Virus Total. If clean, the vault apps were exercised manually to ensure that they contained the claimed vault-like functionality. The SHA256 hash of each app was computed and stored. Each app was processed with Androguard to extract the app properties in XML format (see Figure 2). The hashes were then re-computed to check that the tool did not modify the apps in any way. Each XML file containing the properties was then post-processed to extract the properties into a CSV file. Long property names were shortened for convenience in the CSV output. The short names were derived by selecting the first letter of the property name and concatenating every first letter of every subsequent word, separated by full stop (\".\") characters (see Table 2 for examples). The process workflow of the proposed method is demonstrated in Figure 3.  
This CSV file containing the matched properties for the 1040 apps was then used as input to several machine learning algorithms. As there were over 500 unique properties detected, resulting in a large sparse matrix, a chi-square test was used to determine the properties that provided the highest contribution to the detection of vault apps. Feature selection was one of the key steps undertaken to increase the model's predictive capability. The SelectKBest method was used, making use of the chi-square test to select the features \begin{table}
\begin{tabular}{c c} \hline \hline
**Property** & **Abbreviation** \\ \hline android.permission.CAMERA & apC \\ \hline android.permission.RECORD\_AUDIO & apR \\ \hline android.permission.ACCESS\_NETWORK\_STATE & apA \\ \hline itairgap.vault.DYNAMIC\_RECEIVER\_NOT\_EXPORTED\_PERMISSION & iavD \\ \hline com.android.vending.BILLING & cavB \\ \hline android.permission.WRITE\_EXTERNAL\_STORAGE & apW \\ \hline android.intent.action.MEDIA\_MOUNTED & aiaM \\ \hline android.permission.INTERNET & apI \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Example properties and their abbreviations. Figure 3: Process workflow of the proposed method. Figure 2: Example manifest XML file generated by Androguard. that contributed most. Further, principal component analysis (PCA) was used to further focus the detection capability. PCA, invented by [PERSON] [21], is a technique designed to reduce high-dimension datasets to make them more manageable and provides an intuitive graphic representation of the relationships between the variables. [PERSON] [22] (p1) describes the purpose of PCA succinctly as \"to reduce the dimensionality of a dataset consisting of a large number of interrelated variables, while retaining as much as possible of the variation present in the dataset. while retaining as much as possible of the variation present in the dataset by transforming to a new set of variables, the principal components (PCs), which are uncorrelated, and which are ordered so that the first few retain most of the variation present in all of the original variables.\". We used the sklearn package for the classifiers, with the default train/test split of 75%/25%. Conventional metrics, viz., accuracy, F1 score, and Matthews correlation coefficient (MCC), were used to evaluate the classifiers.