# TrojanDetector: A Multi-Layer Hybrid Approach for Trojan Detection in Android Applications
## 2 Related Work
They took only sys call features. However, they used a set of a total of 61 sys calls. In addition to that, they used random forest, Naive Bayes, and J48. Their experimental results show that random forest achieved the highest detection accuracy of 81.2%, with the lowest false positive rate of 0.188. On the other hand, TrojanDetector targeted three main layers of Android: the application-level layer, user-level layer, and package-level layer. Compared to the state-of-the-art, we selected features from all these layers and targeted almost the ten most crucial Trojan families. All of the features were selected by taking into account the Trojan families. Similarly, the proposed approach used four classifiers for predicting Trojan viruses in Android devices: random forest, decision tree, linear regression, and SVM. By comparing \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Trojan Detectors**} & \multirow{2}{*}{**Dataset Used**} & **Intrusion Detection** & **Feature Selection on** & **Analysis Approach** & **Accuracy of Malware Detection** \\  & & **and Classification Techniques** & **Detection** & & **\\ \hline MiMaLo (13) & MiMaLo technique & Neural Network & & & \\  & & Algorithm & Application & Static & 88.5\% \\ \hline DroidSieve (12) & exploited & & & & \\  & obfuscation-invariant features & & & & 99.82\% \\ \hline [PERSON] et al. (15) & Tested on emulators & STAMINA approach & & & Nil \\  & Apps: Google play store & & & & \\  & and Malware: from & & & & \\  & Contagio community and & & & & \\  & Gnome project & & & & \\ [PERSON] et al. (16) & CICAndMal2017 & ML-based random & & & 98\% \\  & Drebin and Gnome along & & & & \\  & with virus total and virus & & Supervised ML & & 97\% \\  & share databases & & & & \\ [PERSON] et al. (2020) & Trojan dataset from Drebin & & Random forest, & & \\  & and google play store & & Naive Bayes, and J48 & & 81.2\% \\ \hline [PERSON] et al. (17) & OmniDroid & AndroPyTool & & & 89.7\% \\ \hline [PERSON] et al. (18) & Genome \& CICMalDroid & ML \& DL & Application & Hybrid \\ \hline [PERSON] and [PERSON] (3) & Own data set created by & & Offline comparisons & & \\  & comparing the patterns of & & of dynamic patterns & & \\  & malware and benign apps & & set to judge the & & \\  & & unknown app. & & & \\ \hline ShielDroid (19) & CICMalDroid & & Random forest, and & & \\  & & Multilayer & & & \\  & & perceptron & & & \\ \hline TrojanDetector & & CCCS-CIC-AndMal-2020, & & Random forest, & (MultiLayer) & & 86.68\% with an \\  & & Cartagio-Mobile and & & decision tree, Linear & Application, user and & Hybrid & EER of 0.1346 and \\  & & 13,559 Trojan samples & Regression, and SVM & package layers & & 96.64\%, with an \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of TrojanDetector with state-of-the-art approaches. our random forest results with the random forest results from [20], our classifier reported an accuracy of 86.68% with an EER of 0.1346. In contrast, according to the selection of features concerning our approach, the SVM classifier achieved the highest accuracy of 96.64% with an EER of 0.036. Further, the state-of-the-art comparison with our proposed approach in Table 1 shows that TrojanDetector is a multilayer simple and accurate Trojan detection scheme. It detects intrusions in general, while specific intrusions are called malware in particular. Common examples of malware categories include worms and ransomware, which can compromise similar scenarios and require the selection of more specific features for their detection. The proposed approach can be integrated with deep learning- and blockchain-enabled frameworks [21; 22] to enhance data privacy and to provide secure communication in such specific Industrial IoT scenarios [23; 24].