# DroidPortrait: Android Malware Portrait Construction Based on Multidimensional Behavior Analysis
## 3 The Overall, Design of DroidPortrait
### Behavioral Model Construction
#### 3.1.1 Behavioral Characteristic Extraction  
The main target for static feature extraction is the AndroidManifest.xml and class.dex files, and we profile the Android apps in six types of features: requested permission, used permission, sensitive API call, action, app component and intent, and extract corresponding features from the Android apps, all of which could serve as a comprehensive indicator for malicious activities. The detailed extraction process is illustrated in Figure 2.  
Figure 1: Architecture of DroidPortrait.  
An essential step in obtaining AndroidManifest.xml, _class.dex_ and Certification _file_ is to decompress the.apk files by using a tool named apktool to dissect Android apk files. After the decompression, the static behavioral features are extracted from these three types of files. The AndroidManifest.xml file contains some important information regarding the Android app, including permission and app component and we define features extracted from this file as Configuration dimension. We will then parse the manifest file by utilizing tools named _XMLPrinter2_ and _TinyXml_, and extract behavioral features of permission, intent and app component. The class.dex file is used to store Dalvik byte code that can be converted to smali code for better behavioral feature extraction and we define this kind of characteristic as code _dimension_. Used permission, sensitive API call can be extracted from smali code. We define several customized extraction rules in xml files. The certification file contains certification and payload information and we define this kind of characteristic as a certification dimension. The app developers typically use their secret keys to sign the apk files when they are released. The certificate information contains several essential developer information such as country, email, organization, which can be used to distinguish among different developers. Listing 1 gives an example of extracting static behavioral characteristic discussed below.  
```
<rule> <id>5</id> <category>FrameworkAPI</category> <description>Extract APIs of Framework</description> <regex>Landroid(/w+)+>>|w+|Landroid(/w+)+>|S|w+</regex> <targetfile>small</targetfile> <multiMatch>true</multiMatch> </rule>
```  
Listing 1: An example of extracting API  
Unlike static behavioral features, dynamic behavioral features are considered to depict the dynamic behaviors of Android apps. To extracting the dynamic features, we first install Android apps and execute them on a real phone or emulator. Notably, we design an automatic approach to first install and execute the Android apps, and then extract corresponding dynamic features. Figure 3 shows the process of characteristic extraction.  
Figure 2: Static behavioral characteristic extraction.  
In Figure 3, we can see that the proposed approach is composed of three modules. The first module is app execution that executes Android apps on either Android phones or emulators in an automated fashion, and then outputs the captured dynamic behavioral features, such as network traffic, system call. This module could also be tuned by applying different conditions, including the composition of Android apps, execution duration or execution behavior. The second module collects dynamic behavioral features and then extracts network packets, flow and system calls. Last, the third module generates behavioral features read from a configurable file and generates dynamic behavioral features, which will be used in malware detection later. Moreover, we use tcpdump to capture network flows generated by the Android app running and use strace to collect system calls. The details about extracting dynamic behavioral features are discussed in [13; 30].  
In a nutshell, Table 1 shows the details of extracted behavioral characteristics from Android apps.