# TrojanDetector: A Multi-Layer Hybrid Approach for Trojan Detection in Android Applications
## 4 Experimental Validation
### Features Extraction  
The Android Profiler is used by the proposed approach to detect how much CPU is used by the Trojan, how much battery is consumed, and how much the Trojan uses RAM and network. Based on these features, our approach trained the proposed machine learning model to detect Trojan applications efficiently. This features extraction phase dynamically examines the collected Trojan.apk samples and extracts the requisite features. Next, it will analyse the source code of an application by identifying system calls, user behaviours, and the data at the package level for each application. Relevant features from every application have been extracted to apply any machine learning technique. Android applications are delivered as.apk files. This is expected since permissions allow applications to perform actions that can potentially harm the user. Trojan applications also tend to request unusual permissions compared to legitimate ones. For each sample, if the requested permission matches the Android permission, it is assigned a 1 to indicate its presence in those samples, while a 0 indicates the absence of the permission. Feature selection is done with the help of information gain. We need to complete the features from the literature review and compare them for information gain. Our proposed approach extracts 23 features related to various processes, such as CPU usage, App-services, etc. We briefly explain these processes and extract features. For the sake of brevity, we only provide an algorithm for calculating network usage. **Network Usage (user-level feature: dynamic)**.This feature describes whether or not this code uses the network. The value of this feature is in Boolean form, either 1 or 0. Algorithm 2 shows the algorithm to capture network usage after the installation of the app over the first 30 s (selected as a reference point) and compare it with bandwidth usage at a particular instance for the same period. ```
Input Trojan apps with the APPs Output Bandwidth value
1. getting.BandwidthBroadcastReceivers = 0
2. BandwidthBroadcastReceivers[] \(\leftarrow\)GetBandwidthBatteryFromBroadcasts
3. foreach BatteryBroadCast in BroadCastsReceivers do
4. CurrentBandwidthValue \(\leftarrow\)GetCurrentBandwidthValue(NetworkLog)
5. BandwidthValueConsumed_After30 Sec \(\leftarrow\)MonitorBandwidthValue(BatteryBroadCast)
6. Value_change = CurrentBandwidthValue - BandwidthValueConsumed_After30 Sec return value change
```  
**Algorithm 2** Calculating Network Stats  
**CPU Usage (package level feature: static)** This feature describes the use of CPU cycles by the Trojan, as there are three levels of CPU utilization. (i) a high describes the highest level of CPU usage (2) (ii) a Medium means the medium amount of CPU usage (1), and (3) a low means the code is using minimum CPU cycles (1). **App-Services (application-level feature: static)** This feature describes whether the Trojan uses the dangerous services which start in the background or not. The value of this feature is also in Boolean. **App-Permission (user-level feature: dynamic)** This feature describes how the Trojan automatically uses dangerous permission. The value of this feature is also in Boolean. **App-APIs (application feature: static)** This feature describes how the Trojan uses third-party APIs designed to get users' information without knowing them. It also describes whether these APIs are running in the background or not. The value of this feature is also in Boolean. **Bandwidth-Consumed (user-level feature: dynamic)** This feature describes the bandwidth consumed by a Trojan application for 30 s. It also uses third-party APIs designed to get the users' information without knowing the use of the bandwidth. These APIs start in the background or not. The value of this feature is in Boolean. **Is-SMS-Sent (user level feature: dynamic)** This feature shows that the Trojan sends the SMS in the background, gets the user's information without their knowledge, and monitors the sending numbers. The value of this feature is in Boolean.