# Web-Based Android Malicious Software Detection and Classification System
## 4 Results and Discussion
\begin{table}
\begin{tabular}{c c c c c c c} \hline
**Permission Name** & \begin{tabular}{c} **Number of Occurrences** \\ **in Malicious Data Set** \\ \end{tabular} & \begin{tabular}{c} **Number of Occurrences** \\ **in Benign Data Set** \\ \end{tabular} & \
\begin{tabular}{c} **Rate of Occurrences in** \\ **Malicious Data Set (\%)** \\ \end{tabular} &
\begin{tabular}{c} **Malicious Value** \\ **Benign Data Set (\%)** \\ \end{tabular} \\ \hline android permission.READ, PHONE, STATE & 4499 & 369 & 89 & 28 & 61 \\ android permission.SEND, SMS & 2992 & 33 & 54 & 2 & 52 \\ android permission.READ, SMS & 2081 & 27 & 38 & 2 & 36 \\ android permission.RICV, SMS & 2135 & 51 & 39 & 4 & 35 \\ android permission.RICV, Bootr, COMPLETED & 2671 & 296 & 48 & 22 & 26 \\ com.addadd.laume permission.BRSTALL, BIROCTU & 1414 & 55 & 26 & 4 & 22 \\ android permission.WRITE, SMS & 1229 & 8 & 22 & 1 & 21 \\ android permission.CAMERA & 227 & 274 & 4 & 21 & \(-\)17 \\ android permission.READ, JETRNAL, STORAGE & 333 & 301 & 6 & 23 & \(-\)17 \\ android permission.ACCESS, NETWORK, STATE & 3677 & 1142 & 66 & 86 & \(-\)20 \\ android permission.WORK, JETRNAL & 2128 & 774 & 38 & 58 & \(-\)20 \\ com.google, android providers and permission.READ, CSRRVICIS & 1 & 289 & 0 & 22 & \(-\)22 \\ android permission.GET, ACCOUNTS & 443 & 473 & 8 & 36 & \(-\)28 \\ com.google, android.c2 dm, permission.RECEVE & 380 & 679 & 7 & 51 & \(-\)44 \\ \hline \end{tabular}
\end{table} 
Table 4: Permissions with the highest and lowest malicious value. When examining Table 4, the READ_PHONE_STATE permission is the one with the highest malicious value. This permission is followed by SEND_SMS, READ_SMS, RECEIVE_SMS and RECEIVE_BOOT_COMPLETED permissions. READ_PHONE_STATE, SEND_SMS, RECEIVE_SMS, READ_SMS, and READ_CONTACTS are also permissions in common with the permissions that Android has identified as dangerous permissions. The confusion matrix is used to calculate the evaluation results. Accuracy, error rate, true positive rate, false positive rate, true negative rate and false negative rate equations are shown below. \[\text{Accuracy: (TN + TP)/Total} \tag{5}\]  
\[\text{Error Rate: 1 -- Accuracy} \tag{6}\]  
\[\text{True Positive Rate: TP/(FN + TP)} \tag{7}\]  
\[\text{False Positive Rate: FP/(TN + FP)} \tag{8}\]  
\[\text{True Negative Rate: TN/(TN + FP)} \tag{9}\]  
\[\text{False Negative Rate: FN/(FN + TP)} \tag{10}\]  
True Positive (TP), number of malware applications that are classified truly as malware. False Negative (FN), number of malware applications that are classified incorrectly as benign. False Positive (FP), number of benign applications that are classified incorrectly as malware. True Negative (TN), number of benign applications that are classified truly as benign. In this study, different methods were used to evaluate benign and malicious data sets. The first method is the evaluation based on 197 permissions that the applications possess in the data sets that are available in Android version of 4.1. In this method, while the malicious values of the applications are calculated, the permissions, except for these 197 permissions, are ignored. The malicious values of the apps are calculated by adding the malicious values of the Android 4.1 permissions that the applications possess. The results obtained based on this evaluation are shown in Table 5.  
When Table 5 is examined, the correct detection rate of the benign data set according to the relevant evaluation is 94.29%. The correct detection rate in the malicious dataset is 92.62%. The overall correct detection rate is 92.91%, and the overall false detection rate is 7.09%. The second method is an evaluation based on the permissions used by the applications in the benign and malicious data sets. In this method, the malicious values of the applications are calculated by adding the malicious values of the permissions the applications possess. The result obtained based on this evaluation is shown in Table 6.