# Dynamic IoT Malware Detection in Android Systems Using Profile Hidden Markov Models
## 6 Conclusions and Future Work  
In this paper, we presented a model to detect malware in IoT Android systems. As a first step, the system dynamically analyzes the malware datasets to extract call sequence features that are used by the applications for completing specified tasks. After that, suspicious calls are selected. Then, the MSA process is done during training to produce a profile for each malware family. Finally, the trained PHMM model is applied to classify malware as malicious or benign and to which family it belongs.  
We evaluated our proposed system using 4785 malicious apps that were extracted from the Drebin dataset and 500 benign apps extracted from Google Play. We took into consideration seven performance measures, including detection rate, precision, recall, accuracy, F-measure, FN and FP. We observed high detection rates (for most malware families), 96.3% accuracy, 94.0% precision, 96.0% recall and 94.9% F-measure with 5% FP and 3% FN. A benchmark test was then conducted against eight rival Android malware detection frameworks. Results showed that our proposed model performed superiorly when compared to other models.  
On the other hand, our model has some limitations. First, it focused on Android IoT systems only. Second, it relied on the Derbin dataset which lacks recent updates. Third, the results are sometimes affected by the FP problem, which means the system might classify a specific system behavior as malicious when it is not.  
Possible directions that can be taken in this field to address these limitations include testing the system on different operating systems and using more recent datasets. Another direction is to reduce the FP problem based on collective detection using Blockchain technology.  
Conceptualization, N.A. and M.A.; Formal analysis, N.A.; Investigation, N.A. and H.K.; Methodology, N.A. and H.K.; Project administration, H.K.; Resources, H.K.; Software, N.A.; Supervision, H.K.; Visualization, M.A.; Writing--original draft, N.A., H.K. and M.A.; Writing--review & editing, H.K. and M.A. All authors have read and agreed to the published version of the manuscript.  
This research project was supported by the Researchers Supporting Project number (RSP2023R204), King Saud University, Riyadh, Saudi Arabia.  
Not applicable.  
Data Availability Statement: Data available in a publicly accessible repository that does not issue DOIs. Publicly available datasets were analyzed in this study. This data can be found here: [www.sec.cs.tu-bs.de/~danarp/drebin/] (accessed on 1 December 2022).  
The authors declare no conflict of interest.  
\begin{table}
\begin{tabular}{l l l l l} \hline
**Reference** & **Static/Dynamic** & **Accuracy** & **Precision** & **Recall** \\ \hline DIP & Dynamic & 96.3\% & 94.0\% & 96.0\% \\ [40] & Dynamic & 91\% & 90.0\% & \(\epsilon\) \\ [16] & Static & 94.5\% & 93.0\% & 95.0\% \\ [35] & Dynamic & 95\% & 92.0\% & \(\epsilon\) \\ [38] & Dynamic & 96\% & \(\epsilon\) & \(\epsilon\) \\ [41] & Dynamic & 93.6\% & 91.0\% & \(\epsilon\) \\ [42] & Dynamic & 80\% & \(\epsilon\) & \(\epsilon\) \\ [43] & Static & 93\% & \(\epsilon\) & \(\epsilon\) \\ [44] & Dynamic & 95.7\% & \(\epsilon\) & \(\epsilon\) \\ \hline \end{tabular}
\end{table}
Table 6: Benchmarking DIP against related work.