# Is Malware Detection Needed for Android TV?
## 6 Conclusions  
The security of Android TVs becomes more important as the demand for smart TVs increases. However, there are some questions about Android TVs' security which we have investigated in our study. The first research question is about the malware ratio for Android TV applications in markets and public datasets. There are many benign Android TV applications on the market, but malicious Android TV applications are hard to find. Out of 1107 Android TV applications collected from a public dataset [20], only 3 were found to be malicious. Additionally, all 370 TV applications collected from a marketplace (APKMirror) were found to be benign. The second research question investigated in our study is about the Android TV malware detection capability of a model trained on an Android smartphone malware dataset. When we tested a model [6] trained on mobile applications, it detected only 20 malware out of 471 malicious applications in the Androzoo Payload-Injected TV dataset. The final research question in our study concerns the performance of Android TV malware classifiers. To detect Android TV malware, a dataset containing benign and malicious applications for Android TVs is needed. We collected Android TV applications, but there was not enough malware in the markets to train a model. Therefore, we converted benign applications by injecting them with the Meterpreter payload and obtained malicious Android TV applications. We extracted the n-grams from the \"AndroidManifest.xml\" and binary source (classes.dex) files in the Android TV applications and obtained 1000 features using the TF-IDF method. As a result of this study, we publicly shared 1000 features from 511 benign and 424 malicious Android TV applications in the training set and 182 benign and 188 malicious Android TV applications in the testing set. We trained nine separate models for detecting Android TV malware and compared their performance. We observed that the discriminant analysis classifier performed better than the other models. Provided with the extracted features, the discriminant analysis model classifies a TV application as malicious or benign in an average of 0.1346 milliseconds, with an F1-Score of 0.9789 and an MCC score of 0.9570. There is extensive literature on Android security for mobile devices, but it is very limited for Android TV devices. In this study, we contributed to the literature on Android TV malware detection. The suggested model can be run on the servers of application markets and be used to scan application packages before their publication. It can be extended to detecting malware running on other types of devices, such as smartwatchesand automotive dashboards. We hope to observe further studies using the features from our public dataset. We also plan to investigate using a dynamic analysis for feature extraction as future work. [PERSON] carried out the literature review, drafted the manuscript, and proposed the methodology. [PERSON] conceived of the study and defined the literature taxonomy. [PERSON] joined in with this study's conception and acted as an academic advisor. All authors have read and agreed to the published version of the manuscript. This research received no external funding. The data underlying this article are publicly shared. A total of 1000 features and class labels from benign and malicious Android TV applications are available at the following website, the Android TV Malware Dataset: [[https://github.com/google/AndroidTVMalwareDataset](https://github.com/google/AndroidTVMalwareDataset)]([https://github.com/google/AndroidTVMalwareDataset](https://github.com/google/AndroidTVMalwareDataset)) (accessed on 15 January 2025). This study was prepared within the scope of the thesis titled \"Security Analysis of Android Applications with Machine Learning Approach\" in the Computer Engineering Department at Istanbul University-Cerrahpasa Institute of Graduate Studies. Author [PERSON] was employed by the company Arcelik A.S.