# PACER: Platform for Android Malware Classification, Performance Evaluation and Threat Reporting +
## 4 PACE: Platform for Android Malware Classification and Performance Evaluation
### Model Building  
Model Building is a compulsory part of the platform. It performs all steps of the machine-learning process such as data collection, pre-processing, feature extraction, training, testing, and saving the trained and tested model. Model Building is an offline process, where models are trained separately from the running instance of _PACE_ and are added incrementally to _PACE_ on a completion basis. The selection and addition of a model depend upon the author's permission and legal boundary to reproduce the selected research works. Currently, for testing and demo purposes, we have trained two models based on Random Forest and Support Vector Machine. These models are based on static features (permissions) and have accuracy of 68% and 93% without any feature engineering or parameter tuning of algorithms, respectively. In Figure 4, the first vertical layer depicts the Model-Building process from dataset collection to the saved trained model.  
The Figure 5 depicts the output of both trained models; in similar ways, the result of other models will be displayed after they are added to the _PACE_.  
The dataset used for training models is the same and collected from AndroZoo project ([[https://androzoo.uni.lu/](https://androzoo.uni.lu/)]([https://androzoo.uni.lu/](https://androzoo.uni.lu/))). During the pre-processing phase, depending on the features  
Figure 4: Workflow and Architecture of PACE. [M-Malware; B-Benign; SM-Static Model; DM-Dynamic Model].  
Figure 5: Output of Trained models.  
a model is using, several operations are performed on each sample from the collected dataset. These are given below:  
1. File Type Detection: As a first step, it is very important to detect the file type of each sample since further steps are file type-dependent.
2. Duplicate Removal: The same sample in the dataset can be present with a different file name. To have only a unique sample in the dataset, file hash is used to filter duplicate samples.
3. Class Labeling: Since _PACE_ is used to perform binary classification, the dataset should have samples from both classes. Class labels are decided based on VirusTotal result. We considered a sample as benign if the VirusTotal's engine shows that the sample is clean, otherwise the sample is considered to be malware.
4. Sample Reversal: Each sample is reversed as per the demand of the feature type of a model. For example, if the underlying model is using _permissions-based_ features for training, the manifest file will be extracted from each sample by simply unzipping the.apk file. On the other hand, if the model is dependent upon features extracted from the source code, the sample would be reverse engineered using tools like apktool, etc. Likewise, various methods will be applied to extract respective features.  
The pre-processed dataset will be passed to the next stage for feature extraction, and depending upon the required feature, the respective feature extractor module will be executed on the dataset. For example, to build a permission feature set, a permissions extractor will be executed on the pre-processed dataset and the result in the set structure will be saved with proper class label, i.e., for malicious application CLASS TYPE 1 and for benign CLASS TYPE 0. After processing all the samples and converting features in the required format, the feature set would be input to the machine-learning algorithm, which is referenced from respective research papers to create a malware classifier. Once the training and testing of the model are completed as per the description given in respective research work, then the tested model would be saved (making model persistence) to be used in the _PACE_. The model building is a one-time process and will be done for all selected research work. The end user or the interface of _PACE_ has no direct connection with this module and can only access if the model is added to the _PACE_.  
In Section 4.2 the PACE architecture is explained in detail and the subsequent sections explain the _interface_ and _user type_ in detail.