# DroidPortrait: Android Malware Portrait Construction Based on Multidimensional Behavior Analysis
## 3 The Overall, Design of DroidPortrait
### Behavioral Tag  
We already extracted several types of behavioral characteristics from five dimensions that are described in Section 3.1.1. In this subsection, behavioral tags are defined. Given that Android malware contains various types of behavior for better analysis, and detect Android malware, describe multidimensional behavioral characteristics for Android malware correlation analysis ability. Figure 4 shows an example tag of Android malware behavior.  
From Figure 4, we list several behavioral tags of Android malware that can describe Android malware's behavior in five dimensions. However, Android malware may contain many behaviors corresponding to different tags. We define them by three different manners, namely behavioral tag based on meta-data, behavioral tag based on a statistical, behavioral tag based on correlation analysis. The behavioral tag based on meta-data are easy to define and obtain by comparing with meta-data, such as IP address or domain name of accessing the unknown server, permission requested by Android malware. However, this kind of tag is too frequent that is not intrinsic to distinguish Android benign app and malware. The second behavioral tag is based on statistical data, which describes Android malware dynamic behavior in a specific time, such as the number of bytes transition between app and server. The third behavioral tag is based on correlation analysis, which can describe the correlation among these kinds of behavioral tags. For example, most Android apps would use the permission to access the Internet, read device data simultaneously. Some of them send device data to well-known servers for app usage statistics; some of them send these data to unknown servers for malicious goals.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Behavioral Characteristic Category** & **Characteristic Name** & **Characteristic Description** \\ \hline \multirow{8}{*}{Network traffic} & Number of packets & Number of packets transmitted between app and server \\  & Number of bytes & Number of bytes transmitted between app and server \\  & Number of received packets & Number of packets received by the app \\  & Average bytes of received packets & Average bytes of packets received \\  & Average size of packets & Average size of packets transmitted \\  & Average size of packets & Between app and server \\  & In/out ratio & Station of traffic size between sent and received of app \\  & Flow duration & TCP session length \\  & Number of bytes per second & Number of bytes transmitted between app and server per second \\  & Length of URI per GET/POST request & The number of resources requested by app \\  & Length of page per GET/POST request & The length of paths visited by the app to obtain the resources \\  & Length of parameter per GET/POST request & The length of parameter contained in each request \\  & sys\_chmond, sys\_chown, sys\_mount, & \\  & sys\_access, sys\_open, sys\_clone, & \\ System call & sys\_getpriority, sys\_mmmp, sys\_read, & \\  & sys\_exit, sys\_kill, sys\_brk, sys\_exece, & \\  & sys\_kill, sys\_times and sys\_mice & \\ \hline \hline \end{tabular}
\end{table}
Table 2: Detail information about selected dynamic behavioral characteristics.  
Using a single of these behavioral tags cannot distinguish the Android benign apps and malware, use their correlation can find a difference between them.