# Dynamic IoT Malware Detection in Android Systems Using Profile Hidden Markov Models
## 4 Methodology
### Data Sets  
We used the Drebin dataset that contains 5560 applications from 179 different malware families. Drebin dataset also, contains the malicious applications from the Malgenome dataset which was collected from 2012-2015 and contains 1260 malware applications from 49 families. The Drebin dataset has been selected for this research for several reasons. First, it contains large amount of malware families, including those from the Malgenome dataset. Second, the benchmarks, which include [16; 35; 38; 40; 41; 42; 43; 44], used the Drebin dataset, which shows its usefulness and popularity in the field and mandates using it to have valid comparisons with the benchmarks.  
To overcome the imbalance issue related to the Drebin dataset where most files have invalid APKs, we analyzed families that contain at least 20 samples and removed apps with invalid APKs. In total, we analyzed 4785 files out of 5560 for our research because some APK files did not work at run time (invalid APK). Table 2 lists the malware families that we worked on from the Drebin dataset, 24 families in total. For the benign dataset, we used 500 applications from the google play store [31].  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Software** & **Description** & & \\ \hline VirtualBox (Oracle VM VirtualBox Manager 6.1.34) & A virtual environment and cross-platform virtualization software that allows users to run multiple operating systems on their computers simultaneously [31]. & \\ Kali Linux 2021.3 & A Linux-based operating system that is designed for use in information security tasks, such as penetration testing, security research, computer forensics, and reverse engineering [25]. & \\ MobSF tool 3.5 & An open-source security framework that can perform dynamic analysis to test mobile applications and tend to end. This tool supports Android Application Package (APK) and iOS package App Store (IPA) binaries, as well as zipped source code [26]. & \\ MUSCLE 3.8.31 & A computer software program for aligning protein and nucleotide sequences [35] to produce.afa files. & \\ HMMER 3.3.2 & A tool used to search for sequence homologs databases and to make sequence alignments. This software implements probabilistic models called hidden Markov Models (HMMs) [9]. & \\ Python & A programming language used for the implementation. & \\ \hline \hline \end{tabular}
\end{table}
Table 1: List of used tools.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**\#** & **Family** & **Samples** & **\#** & **Family** & **Samples** \\ \hline
1 & Adrd & 91 & 13 & Glodream & 69 \\
2 & BaseBridge & 330 & 14 & Hambo & 28 \\
3 & Boxer & 27 & 15 & Iconosys & 152 \\
4 & DroidDream & 81 & 16 & Imlog & 43 \\
5 & DroidKungFu & 667 & 17 & Jifake & 29 \\
6 & ExploitLinuxLotoor & 70 & 18 & Kwin & 147 \\
7 & FakeDoc & 132 & 19 & MobileTx & 69 \\
8 & FakeInstaller & 925 & 20 & Opfake & 613 \\
9 & FakeRun & 61 & 21 & Plankton & 625 \\
10 & Gappusin & 58 & 22 & SendPav & 59 \\
11 & Geinimi & 92 & 23 & SMSreg & 41 \\
12 & Ginmaster & 339 & 24 & YZHC & 37 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Considered malware families from the Drebin dataset.