# Research on Data Mining of Permission-Induced Risk for Android IoT Devices
## 2 Literature Review
### Static Analysis
#### 2.1.2 Suspicious API Calls  
The second solution is a static analysis of the source code of the app. Malicious codes usually use a combination of services, methods and API calls that are not common for non-malicious applications [12]. To differentiate malicious and non- malicious applications, the Machine learning algorithms are able to learn common malware services such as combinations of APIs and system calls. Figure 3 shows the some of suspicious API calls, which are mostly used by malware applications. Figure 4 shows the extracted the features from the APK file that contains the classes.dex file.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Ref** & **Features** & **Accuracy** & **Machine Learning Models** \\ \hline
[36] & Permission & 91.75\% & Random Forest \\
[19] & Permission & 81\% & C4.5, SVM \\
[37] & Permission & 88.2\% & HMNB \\
[15] & Permission & - & AHP \\
[21] & Permission & 98.6 & J48 \\
[20] & Permission & 92.79\% & Random Forest \\
[38] & Permission & 94.90\% & Random Forest \\
[14] & Permission, API calls & 92.36\% & Random Forest \\
[23] & Permission, API calls, intent & 97.87\% & k-nearest neighbors \\
[39] & API call & 99\% & k-nearest neighbors \\
[40] & API call & 93.04\% & Signature matching \\
[41] & API call & 96.69\% & SVM \\
[42] & ICC related features & 97.4\% & SVM \\
[9] & Permission, command, API calls & 98.6\% & Parallel classifier \\ \hline \hline \end{tabular}
\end{table}
Table 1: Static features detection methods.  
\begin{table}
\begin{tabular}{c c c} \hline \hline  & \multicolumn{2}{c}{**Feature Sets**} \\ \hline \multirow{4}{*}{manifest} & S1 & Hardware components \\ \cline{2-3}  & S2 & Requested permissions \\ \cline{2-3}  & S3 & Application components \\ \cline{2-3}  & S4 & Filtered intents \\ \hline \multirow{4}{*}{dexcode} & S5 & Restricted API calls \\ \cline{2-3}  & S6 & Used permission \\ \cline{1-1} \cline{2-3}  & S7 & Suspicious API calls \\ \cline{1-1} \cline{2-3}  & S8 & Network addresses \\ \hline \hline \end{tabular}
\end{table}
Table 2: Overview of feature sets.  
\begin{table}
\begin{tabular}{l l} \hline \hline \multicolumn{1}{c}{**Risky Permissions**} \\ \hline ACCESS\_WIFI\_STATE & SEND\_SMS \\ READ\_LOGS & READ\_CALL\_LOG \\ CAMERA & DISABLE\_KEYGUARD \\ CHANGE\_NETWORK\_STATE & RESTART\_PACKAGES \\ WRITE\_APN\_SETTINGS & SET\_WALLPAPER \\ CHANGE\_WIFI\_STATE & INSTALL\_PACKAGES \\ READ\_CONTACTS & WRITE\_CONTACTS \\ WRITE\_SETTINGS & GET\_TASKS \\ RECIVE\_MMS & ACCESS\_WIFI\_STATE \\ WRITE\_APN\_SETTINGS & SYSTEM\_ALERT\_WINDOW \\ READ\_HISTORY\_BOOKMARKS & RECEIVE\_BOOT\_COMPLETED \\ ACCESS\_NETWORK\_STATE & CALL\_PHONE \\ READ\_EXTERNAL\_STORAGE & ACCESS\_FINE\_LOCATION \\ EXPAND\_STATUS\_BAR & ADD\_SYSTEM\_SERVICE \\ PERSISTENT\_ACTIVITY & INTERNET \\ GET\_ACCounts & WRITE\_SMS \\ PROCESS\_OUTGOING\_CALLS & CHANGE\_CONFIGURATION \\ READ\_HISTORY\_BOOKMARKS & GET\_PACKAGE\_SIZE \\ WAKE\_LOG & ACCESS\_MOCK\_LOCATION \\ WRITE\_CALL\_LOG & WRITE\_HISTORY\_BOOKMARKS \\ READ\_PHONE\_STATE & RECEIVE\_WAP\_PUSH \\ SET\_ALARAM & WRITE\_SMS \\ RECEIVE\_SMS & READ\_SMS \\ \hline \hline \end{tabular}
\end{table}
Table 3: Permission set mostly used in malware.  
Figure 3: Suspicious API calls.