# Research on Data Mining of Permission-Induced Risk for Android IoT Devices
## 4 Experimentation and Results
### Association Rule Mining Algorithm Based Feature Selection  
We generate the top permission based on data mining association rule Algorithm. The permission WRITE_SMS frequently appear in benign and malware, while READ_SMS is mainly used by malware. When we delete the privilege WRITE_SMS, the application requesting permission READ_SMS is likely to be classified as malware. Furthermore, we found that WAKE_LOCK, and READ_HISTORY_BOOKMARKS and WRITE_HISTORY_BOOKMARKS, and READ_PHONE_STATE have a high occurrence of being associated. After trimming the three permission characteristics in the dataset, we only reserved some features. Then we observed that a new model using the permissions set in Table 7.  
\begin{table}
\begin{tabular}{l c c} \hline \hline
**Permission Patterns** & **Benign** & **Malware** \\ \hline \multicolumn{3}{c}{Common Android request permission} \\ \hline READ_PHONE_STATE, ACCESS_WIFI_STATE & 2.36 & 63.08 \\ INTERNET, ACCESS_WIFI_STATE & 5.05 & 63.49 \\ READ_PHONE_STATE & 31.87 & 93.4 \\ ACCESS_WIFI_STATE & 5.22 & 63.49 \\ ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE & 3.99 & 60.31 \\ INTERNET, WRITE_EXTERNAL_STORAGE, READ_PHONE_STATE & 13.28 & 65.44 \\ INTERNET, READ_PHONE_STATE, ACCESS_NETWORK_STATE & 24.21 & 78.97 \\ INTERNET, READ_PHONE_STATE & 31.21 & 93.078 \\ WRITE_EXTERNAL_STORAGE, READ_PHONE_STATE & 13.37 & 65.53 \\ READ_PHONE_STATE, ACCESS_NETWORK_STATE & 24.21 & 79.05 \\ \hline \multicolumn{3}{c}{Common Android Run-time Permissions} \\ \hline READ_PHONE_STATE, ACCESS_NETWORK_STATE & 23.63 & 77.18 \\ INTERNET, READ_LOGS & 6.85 & 6.85 \\ READ_PHONE_STATE & 30.32 & 91.69 \\ INTERNET, READ_PHONE_STATE, ACCESS_NETWORK_STATE & 26.36 & 77.18 \\ READ_PHONE_STATE,VIBRATE & 21.92 & 65.28 \\ INTERNET, READ_PHONE_STATE & 29.9 & 91.52 \\ READ_PHONE_STATE, READ_LOGS & 5.38 & 46.86 \\ READ_LOGS & 6.93 & 47.6 \\ INTERNET, READ_PHONE_STATE, VIBRATE & 21.68 & 65.12 \\ \hline \multicolumn{3}{c}{Unique Android request permission} \\ \hline READ_PHONE_STATE, WRITE_SMS & 0 & 50.94 \\ INTERNET, READ_PHONE_STATE, ACCESS_WIFI_STATE & 0 & 63.09 \\ ACCESS_NETWORK_STATE, RECEIVE_BOOT_COMPLETED & 0 & 51.68 \\ ACCESS_NETWORK_STATE, WRITE_SMS & 0 & 49.64 \\ RECEIVE_BOOT_COMPLETED & 0 & 42.63 \\ READ_PHONE_STATE, ACCESS_WIFI_STATE & 0 & 44.75 \\ WRITE_EXTERNAL_STORAGE, ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE & 0 & 54.53 \\ READ_PHONE_STATE, RECEIVE_BOOT_COMPLETED & 0 & 43.12 \\ INTERNET, SEND_SMS & 0 & 43.12 \\ INTERNET, ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE & 0 & 60.31 \\ \hline \multicolumn{3}{c}{Unique Android Runtime Permissions} \\ \hline INTERNET, READ_PHONE_STATE, ACCESS_NETWORK_STATE, VIBRATE & 0 & 55.42 \\ ACCESS_NETWORK_STATE, VIBRATE, READ_LOGS & 0 & 38.55 \\ READ_PHONE_STATE, ACCESS_NETWORK_STATE, READ_LOGS & 0 & 43.2 \\ READ_LOGS, INTERET, ACCESS_NETWORK_STATE & 0 & 43.2 \\ READ_PHONE_STATE, VIBRATE, READ_LOGS & 0 & 41.33 \\ INTERNET, VIBRATE, READ_LOGS & 0 & 41.49 \\ READ_LOGS, INTERNET, READ_PHONE_STATE, & 0 & 46.87 \\ ACCESS_FINE_LOCATION, READ_PHONE_STATE, VIBRATE,INTERNET & 0 & 34.23 \\ INTERNET, SEND_SMS & 0 & 33.58 \\ INTERNET, ACCESS_FINE_LOCATION, READ_LOGS & 0 & 28.45 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Permission Patterns Malware and Benign.  
We arrange that different permission ordering methods result in different sorted lists. For instance, we give up INTERNET permissions because it indicates that both benign and malicious applications usually require INTERNET. However, the mutual information-based ranking method saves the permission INTERNET, because all applications often request the permission INTERNET. Therefore, we believe that our algorithms can preserve more important permissions by deleting unimportant or irrelevant permissions. Our approach distinguish malware applications (with a higher review rate), which is necessary for malware detection.