# PACER: Platform for Android Malware Classification, Performance Evaluation and Threat Reporting +
## 3 PACER: Platform for Android Malware Classification, Performance Evaluation, and Threat Reporting  
After going through the aforementioned literature on ML-based Android malware detection, and studied the working of various platform related to Android malware and automated reporting systems, our observations are summarized as follows:  
* There are many quality studies on Android malware detection using both static and dynamic features, but they all are up to academic research level and are not available to end users or researchers in a usable form. Our earlier work _PACE_ is an attempt to fill this gap between academic research and the end user.
* The comparison of various detection techniques is complex and difficult because of varying datasets and the unavailability of implementation of the earlier works. With _PACE_ we offer a common platform to compare the results of multiple methods on the same dataset and evaluate performance.
* The reproducibility and transparency is an important concern of the applied research domain. _PACE_ provides a platform for conducting reproducible and transparent research.
* The implementation of many earlier studies and datasets are either closed source or available on request. As research work grows older, keeping pace with contact and project becomes difficult, as the research contact (i.e., website, link, email) became obsolete.
* Very often, research works are not available in a usable format, with various interface options such as REST API, Web Interface, ADB, etc. _PACE_ is a solution that makes research available to different kinds of users i.e., from end users to security practitioners.
* With a centralized submission system, _PACE_ would be very helpful for Android threat intelligence by analyzing the sample daily and sharing the intelligence through the dashboard.
* Automatically generating a simple, meaningful, and readable threat intelligence report for the user device is very important for convincing and making the naive and non-technical user understand about security risks. With the extended work _PACE_, we try to address the issue of threat accessibility and understandability for the naive user by providing a simple, meaningful and readable report that has _PACE_ scanning results along with other threat results such as _CVE_ matching, outdated apps, etc.  
The proposed work _PACE_ is an extension of our previous work _PACE_. It extends the functionality of _PACE_ and provides mechanisms to generate an automated threat intelligence report of an end-user device. The Threat Intelligence Reporting (TIR) module can be developed in two ways either as a plugin for existing _PACE_ (can use ADB interface to access device) or as an independent system, and can access _PACE_ scanning through an API interface. With such open architecture, it is possible to include other malware classification tools (which have interfaces to accept apk as input and provides classification results as'malware' or 'benign') into _PACE_ along with _PACE_ or by replacing it.  
Currently, we have developed TIR as _PACE_, which is an independent system and uses _PACE_ for malware scanning results. Figure 3 depicts the architecture of _PACE_, which has _PACE_ as a module. _PACE_ is mainly divided into three modules: _Data Processing_, _Threat Analyzer_, and _Report Generator_. Each of these modules are explained in detail in the following sections.