# Web-Based Android Malicious Software Detection and Classification System
## 3 Web-Based Android Malicious Software Detection and Classification System
Google's subsidiary VirusTotal is a free online service that analyzes files and URLs that identify viruses, worms, Trojans, and other malicious content, as detected by virus protection engines and website scanners [44]. There are four methods for analyzing Android applications with VirusTotal: the web page, VirusTotal application installation tool, sending a mail and VirusTotal API. In this study, applications were analyzed using VirusTotal API. VirusTotal integration was added with the idea of using it for the purpose of the detection of non-new malware variants. When the literature was reviewed, it was seen that VirusTotal has been used in many studies. The md5 hash code of the application analyzed in the static analysis section of the Mobile-Sandbox study was compared with all the hashes in the VirusTotal database. If the hash is found, the \"detection rate\" is calculated by dividing the number of tools classifying the application as malicious by using the number of antivirus tools analyzing the application [12; 45]. In the study conducted by [PERSON] et al., VirusTotal was used to determine whether the applications used in the data set were malicious [43]. In the study of [PERSON] et al., VirusTotal was used to generate a data set of benign applications [15]. The VirusTotal score was not evaluated for the final result, but it was used as a parameter at the point of determining whether the application was malicious or not. The VirusTotal score is calculated for each application in this study. The formulated form of this calculation is shown in Equations (2)-(4). \[\textit{Total (MV)}=\sum_{i=0}^{\text{number of permission}}\text{ Malicious Value of Permission (t)} \tag{2}\]  
\[\textit{VirusTotalScore}=\text{(The Number of Antivirus Programs that Find The Application} \tag{3}\]  
\[\textit{Malicious}/\textit{Total Antivirus Program Number)}^{\star}100 \tag{4}\]  
\[\textit{Final Malicious Value}=\text{(Total (MV) + VirusTotalScore)}/2 \tag{5}\]  
A threshold value was determined using the final malicious values of the applications in the benign and malicious data sets by using the Receiver Operating Characteristics curve. The receiver operating characteristics curve is drawn as a graph calculated for different threshold values, with the true positivity (sensitivity) rates on the vertical axis and the false positivity (1-specificity) rates on the horizontal axis [46]. Figure 2 shows the curve of receiver operating characteristics represents excellent, good and worthless tests. When Figure 2 is assessed, the area remaining under the curve represents an excellent test. If the area under the curve is 0.5, it represents a worthless test. In the fifth step, the applications were determined as being benign or malicious software based on this threshold value. The Accord.Statistics.Analysis [48] library was used to calculate the threshold value through the receiver operating characteristics curve. The algorithm of the piece of code used to determine the threshold value by using this library, as shown in Figure 3. A web-based client was developed for evaluating unknown Android applications. The server made by the Android application was subjected to some steps; namely, reverse engineering, computing of the malicious value of the application, and determining of the threshold value respectively. Then, the results of the analysis were saved in the database and sent to the client. Figure 3: The algorithm used to calculate the threshold value. Figure 2: Comparison of receiver operating characteristics curves [47]. When Figure 3 is considered, in order to use the ReceiverOperatingCharacteristic object, it is essential that sequences allow the distinguishing of the benign and malicious applications, and the sequences that hold the total values possessed by the benign and malicious applications need to have been generated. These generated sequences were added as input to the ReceiverOperatingCharacteristic method. In the next step, a threshold value curve with 100 coordinate values was calculated.