# Advanced Financial Fraud Malware Detection Method
## 3 Proposed Malware Detection Approach
### Feature Extraction  
Upon obtaining the data, the features for model training were extracted. We analyzed the raw data and added two categories to the six feature sets listed in Table 6: user information and app package name statistics. The selection of \"user information\" and \"app package name statistics\" as additional feature sets was based on their relevance in enhancing the detection of financial fraud malware. \"User information\", which includes demographic details such as age group and sex, can provide valuable insights into risk patterns associated with malware infections. Certain demographics may be more vulnerable to specific types of malware or targeted attacks. Additionally, \"app package name statistics\" help identify suspicious or uncommon app names, often used by malicious apps to masquerade as legitimate ones. These features complement traditional static analysis techniques and improve the accuracy of the model in distinguishing between benign and malicious apps. Consequently, eight feature sets were obtained. Moreover, 57 variables were added to the 14 listed in Table 4 to extract 71 features. Tables 5 and 6 list the final selected feature sets. * Target: The \"label\" in the raw data to determine if an app is malicious. This was used as the dependent variable to train the model. * App information: \"App package name\" and \"app size\" were selected from the raw data. Some information in \"app size\" was missing; therefore, a derived variable called \"app size Null indicator\" was added. \"App name\" was excluded from this study because it requires further research on natural language processing as it contains data in various languages, including English, Korean, Chinese, and Japanese. * App permissions: These were extracted from the manifest.xml file. Permission information is a key element in determining whether an app is malicious, as evidenced by several related studies on static analysis of malware apps [10,25,27,29,33,35,37]. From the information on numerous permissions, this study utilized that on \"read SMS permission\", \"write SMS permission\", \"process outgoing calls permission\", \"call phone permission\", \"request install packages permission\", and \"manage external storage permission?\". \begin{table}
\begin{tabular}{c c c c} \hline
**Feature Set** & **Feature Name** & **Description** & **Type** \\ \hline \multirow{8}{*}{App permissions} & read\_sms & SMS read permission & Categorical \\ \cline{2-4}  & receive\_sms & SMS write permission & Categorical \\ \cline{2-4}  & process\_outgoing\_calls & Permission to process outgoing calls & Categorical \\ \cline{2-4}  & call\_phone & Permission to make calls & Categorical \\ \cline{2-4}  & request\_install\_packages & Permission to request the installation of packages & Categorical \\ \cline{2-4}  & manage\_external\_storage & Permission to manage shared storage & Categorical \\ \hline App service & base\_phone\_app & Whether it is the default phone app & Categorical \\ \hline \multirow{8}{*}{User activity} & app\_src & App source & Categorical \\ \cline{2-4}  & app\_src\_cnfm\_yn & Whether the app source is verified & Categorical \\ \cline{2-4}  & lst\_af\_psg\_drtm & The elapsed time after the installation (Installation date to Transaction date) & Numerical \\ \cline{2-4}  & lst\_af\_pst\_drtm\_yn & Whether the elapsed time after the installation is Null & Categorical \\ \cline{2-4}  & age & Age & Numerical \\ \cline{2-4}  & age\_yn & Whether the age is Null & Categorical \\ \cline{2-4}  & gndr\_dv\_cd & Gender & Categorical \\ \hline \end{tabular}
\end{table} 
Table 5: _Cont._* App service: A service is a background component that runs independently of the user interface [62]. The services were also extracted from the manifest.xml file. In this study, only services that could determine the default phone app indicators were used. * User activity: Classification of elements changed by user activity.