# PACER: Platform for Android Malware Classification, Performance Evaluation and Threat Reporting +
## 2 Background
### Machine-Learning-Based Android Malware Detection
#### 2.1.3 Threat Intelligence Reporting  
A report is an organized representation of data that helps to understand data easily and is helpful in sharing the information with others. The two main attributes of any report are that it must be for a specific audience and for a specific purpose ([[https://en.wikipedia.org/wiki/Report](https://en.wikipedia.org/wiki/Report)]([https://en.wikipedia.org/wiki/Report](https://en.wikipedia.org/wiki/Report))). In this regard, a technical report becomes time-consuming and tedious to write and demands a specific set of skills for both the creator and the reader. For example, presenting the security analysis report of an Android device that includes various threats posed by installed applications and the Android OS is very complex and requires high technical skills. Thus, the automatic generation of a report based on the various OS and app activities on Android devices is a key area of research that makes attempts to fulfill different requirements such as legal requirements, security analysis, and threat intelligence through monitoring, observing, extracting, and analyzing apps to OS interactions and vice versa. [PERSON] et al. have presented an automated crash reporting system name _CRASHSCOPE_[43]. The main task of _CRASHSCOPE_ is to generate an automated augmented report after the occurrence of a crash in an Android device by any app. The report includes screenshots, crash reproduction steps, and script, and stack trace. The author [PERSON] has proposed a reporting system for forensic purposes that automatically collects system activities and provides a report for various stakeholders such as incident responders, security auditors, proactive security monitors, and forensic investigators [44]. This reporting system provides system traces as a dataset, but similar reporting can be also used for threat intelligence reporting. The _ANANAS_[45] also has a reporting module that generates a readable report by applying various filters on the stored raw data in the database. The raw data (various log files) are collected and stored in the database after performing the analysis through other modules of _ANANAS_. [PERSON] et al. presented their work _FUSION_ which helps in the automation of bug reproduction and reporting for mobile apps [46]. In this paper, we propose _PACER_, which extends _PACE_ by adding threat intelligence and reporting (pdf) for the end-user device through _ADB interface_.  
\begin{table}
\begin{tabular}{l l c c c c} \hline \hline \multirow{2}{*}{**Authors**} & \multirow{2}{*}{**Features**} & \multicolumn{3}{c}{**Performance Metrics**} & \multirow{2}{*}{**Best Model**} \\ \cline{3-3} \cline{5-6}  & & **Accuracy** & & **FPR** & **TPR** \\ \hline [PERSON] et al. [33] & App traces & 94.53 & 14.85 & 97.66 & Random Forest \\ \hline [PERSON] et al. [34] & \begin{tabular}{c} User’s trace \\ (Crowdsourcing) \\ \end{tabular} & NA & NA & NA & Clustering \\ \hline [PERSON] et al. [35] & Only Dynamic analysis & NA & NA & NA & NA \\ \hline [PERSON] et al. [32] & Network, File I/O etc. & 86.1 & 0.857 & NA & SVM \\ \hline [PERSON] et al. [36] & \begin{tabular}{c} Features based on CPU, \\ Memory, Battery etc. \\ \end{tabular} & 99 & NA & NA & Random Forest \\ \hline [PERSON] et al. [37] & API and corresponding arguments & NA & NA & NA & NA \\ \hline [PERSON] et al. [38] & Static and Dynamic & 96.5 & NA & NA & \begin{tabular}{c} Deep Learning \\ (DBN) \\ \end{tabular} \\ \hline DroidDetector [39] & Static and Dynamic & 96.76 & NA & NA & \begin{tabular}{c} Deep Learning \\ (DBN) \\ \end{tabular} \\ \hline [PERSON] et al. [40] & \
\begin{tabular}{c} Network and Device \\ Activities \\ \end{tabular} & NA & NA & NA & Anomaly-Based \\ \hline [PERSON] et al. [41] & Integrated system logs & 98 & NA & NA & Profiling \\ \hline [PERSON] et al. [42] &
\begin{tabular}{c} Network activities, and File \\ R/W \\ \end{tabular} & 97 & 3 & 97.1 & Random Forest \\ \hline \hline \end{tabular}
\end{table}
Table 3: Android Malware Detection Using Dynamic Features.