# Web-Based Android Malicious Software Detection and Classification System
## 3 Web-Based Android Malicious Software Detection and Classification System  
The developed system uses the static analysis method for the analysis of Android applications. The Android version used was chosen to be 4.1, due to the highest targetSdkVersion information of the applications in the Drebin malware dataset [9] being 16. The reason for this selection is that the permissions used by applications in the malicious dataset practice permissions that are present in the Android 4.1 version. To create a benign application data set, Android applications of official institutions in Turkey, other countries, and popular applications on the Google Play market were downloaded by using the APKPure [35] web page. The APKPure web page is a platform for downloading Android.apk files. By using this web page, 1331 applications were manually downloaded and a benign data set was created. The data set created in the Drebin [9] study was used for collecting the malicious software data set, which has been shared as an open resource. This data set contains 5560 applications from 179 different malware families. These samples were collected in a period from August 2010 to October 2012 [36; 37]. Since applications added to Google Play Market in the benign dataset did not go through a detailed analysis process to determine whether the applications in the benign data set were safe or not, the safety was checked using the VirusTotal API [38]. VirusTotal was used in the studies of AndroDialysis [20], [PERSON] et al. [39], [PERSON] et al. [40] and ICCDetector [41], which are available in the literature to ensure the safety of the applications that are used in benign data sets. 158 applications were found to be malicious by at least one antivirus program, namely the VirusTotal scanning, to sustain safer applications in the data set. As a result, a summary of the data set obtained is shown in Table 1.  
For the static analysis methods, information obtained from the permissions that the applications use was utilized. In related works, API calls are also used as an attribute during static analysis; but these were not included in this study because it involves source code analysis. The architecture of the developed system is shown in Figure 1. \begin{table}
\begin{tabular}{c c c} \hline
**Data Set Type** & **\#** & **Source** \\ \hline Malicious & 5545 & Drebin \\ Benign & 1173 & Google Play market \\ \hline \end{tabular}
\end{table} 
Table 1: Summary of data set created as per VirusTotal. Figure 1: Architecture of the developed system. The.apk files in the benign and malicious data sets were reverse engineered using the Apktool tool. The permissions found in the AndroidManifest.xml file were obtained and then the permissions that each application possessed were saved in the created database. In the third step, the permissions found individually in the malicious and benign data sets were obtained. The percentage of availability of these permissions for malicious and benign data sets was calculated. Lastly, the percentage of availability for malicious software was subtracted from the percentage of availability for benign software, and the value that we designated the malicious value was calculated. The formulated representation of this process was shown in Equation (1). \[\textit{Malicious Value of Permission}=\sum_{i=0}^{n}\textit{MV\_Malicious}(t)- \sum_{i=0}^{n}\textit{MV\_Benign}(t) \tag{1}\]  
The total malicious value of each application was obtained by adding and evaluating the malicious values of the permissions that each application possesses. Additionally, the results of each application in the VirusTotal database were obtained using the API of VirusTotal in this step. Here, the reason for using VirusTotal to calculate the malicious values of applications is its ability to show the results of more than 50 anti-virus programs [42], and it is used in security-based studies in the literature. The studies of [PERSON] et al. [43] and [PERSON] et al. [15] can be given as examples of these studies.