# Research on Data Mining of Permission-Induced Risk for Android IoT Devices
## 1 Introduction  
Nowadays, smart devices have become part of the Internet of Things (IoT), and are widely used in almost every domain such as banking, shopping, social networking, etc. The adoption of the Android platform for smart devices provides a variety of services all over the world. Smart devices that use the architecture of IoT include smart TVs, refrigerators, automobiles, wrist watches, etc. Figure 1 shows some applications areas which use android apps for connecting IoT devices. In the framework of IoT, smartphones are providing numerous advantageous IoT services to clients such as cell phone's housed sensing (accelerometer, Gyroscope, compass, GPS) and connectivity alternatives (i.e., NFC, RFID, WiFi, Bluetooth). Moreover, smartphones are also used to control and monitor personal and business premises such as controlling the air temperature using Android apps or using CCTV cameras to track work progress. Consequently, in our inexorably associated society, the number and scope of Android devices keep on increasing. It is assessed that there will be roughly 6.1 billion smartphone clients by 2020 [1; 2]. On the other side, Android devices are an increasingly attractive target for online criminals who try to hold personal details (i.e., location, contact numbers, accounts, photos, etc.) [3]. This unethical act is targeted by malicious hackers who are trying to use Android application as a tool to break into devices. In addition to this, most of the Android devices do not use anti-virus or malware detection applications [4; 5; 6]. Additionally, to control a violation of privacy and the leakage of data such as the location of the user, contact information and smartphone certificates, hackers pose a severe threat. The previous literature reports several techniques to address the problem of malware attacks, such as a sandbox, access control, signature mechanism, authority mechanism [7; 8; 9]. Furthermore, in [3], a M0 Droi framework based on API calls has been proposed that generate signatures which are pushed to the client devices for danger identification. However, TaintDroid [10] developed an exception-based malware discovery system based on usage of application data behaviour. Moreover, [PERSON] et al. [11], designed a structure to monitor Android Dalvik activity codes regarding frequencies, which can detect malware applications. Besides, [PERSON] et al. [12], proposed Crowdroid framework for the client and server components. The client uses the strace mechanism of the Linux system for monitoring android system calls. [PERSON] et al. [13], proposed CopperDroid framework, which detects the behaviour of Java code and local code execution. Although, these reported methods are very effective, yet, these methods can not be directly applied to mobile and IoT devices, because of their limited resources such as memory and power consumption. Several techniques are developed for selecting the permission [14; 15; 16; 17] for instance information gain technique [14], permission but they considered only high-risk permission and ignored the low-risk permissions. Permission control is a key problem in the security of the Android operating system. Android permissions enforce the restrictions on the specific operation to offer concrete security features. However, it places a significant responsibility on app developers to declare the least privileged set of permissions required by designed apps, and it is up to the app users to completely understand the risk of granting certain permissions. The Android platform provides plenty of documentation with limited information regarding permission. The lack of reliable permission information may allow app developers to request unnecessary permissions, which may lead to overprivileged applications. Additionally, unnecessary perilous permissions may lead to malware apps, which can generate permission oriented attacks. Moreover, the lack of information about the risk level of permissions confuses the users, whether to install the app or not.