# Permission Sensitivity-Based Malicious Application Detection for Android

Authors: Yubo Song; Yijin Geng; Junbo Wang; Shang Gao; Wei Shi
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Since a growing number of malicious applications attempt to steal users’ private data by illegally invoking permissions, application stores have carried out many malware detection methods based on application permissions. However, most of them ignore specific permission combinations and application categories that affect the detection accuracy. The features they extracted are neither representative enough to distinguish benign and malicious applications. For these problems, an Android malware detection method based on permission sensitivity is proposed. First, for each kind of application categories, the permission features and permission combination features are extracted. The sensitive permission feature set corresponding to each category label is then obtained by the feature selection method based on permission sensitivity. In the following step, the permission call situation of the application to be detected is compared with the sensitive permission feature set, and the weight allocation method is used to quantify this information into numerical features. In the proposed method of malicious application detection, three machine-learning algorithms are selected to construct the classifier model and optimize the parameters. Compared with traditional methods, the proposed method consumed 60.94% less time while still achieving high accuracy of up to 92.17%.


---

## Body

## 1. Introduction

Nowadays, Android operating system occupies 85% of the market share and has become the most popular mobile operating system. However, owing to the increase in usage and the source’s openness, the Android system becomes the target of malware. According to the report on China’s mobile phone security status in the first half of 2020, 360 Security Brain intercepted approximately 1.048 million new malware samples on the mobile terminal, approximately 6 thousand new ones added every day. These malicious applications hidden in some application stores have access to users’ privacy, resulting in information leakage of private data and economic loss, affecting the Android ecosystem’s healthy development [1, 2]. Therefore, the research on efficient malware detection methods for application stores is very crucial. However, the traditional detection methods based on permission features mostly have the following problems:(i)
The legality of requesting the same permission is different in various categories of applications. For example, requesting permission to read contacts is a legal behavior in social chat applications, but it is usually regarded as a malicious behavior in photo-taking applications. In general, putting all types of Android applications in the same data set together may cause misjudgment.(ii)
Many malicious behaviors need to call multiple permission combinations. For example, the malicious behavior of uploading contact information to a website requires calling READ_CONTACTS and Internet permissions. Therefore, analyzing the information of permission invocation, ignoring the influence of some specific permission combination on the malware detection will result in the decrease of the detection accuracy.(iii)
Some permission features cannot effectively distinguish between benign applications and malicious applications. Taking such permission features into consideration will lead to many invalid features, which will reduce the accuracy of detection and cost more detection time.To solve the above problems, considering the coarse-grained authorization mechanism of the Android system, we present an Android malware detection method based on permission sensitivity. This method screens the permission features and permission combination features based on permission sensitivity to obtain the sensitive permission feature sets of various applications. The weight allocation method is then used to quantify the sensitive permission features, thus realizing malware detection. The main contributions of our work are summarized as follows:(i)
An automatic classification method based on semantic analysis is proposed. The application’s primary function is identified through the semantic analysis of the application description text, and then the label category can be attached to the application.(ii)
Considering the sensitivity of permission features and permission combination features under various category labels are different, the permission feature set is filtered to obtain the application’s sensitive permission feature set to perform malicious application detection.(iii)
We propose a method of processing permission features based on weight allocation. Considering that permission features have different abilities to distinguish malicious and benign applications, the corresponding weights are assigned to different features. Thus application permission request information can be converted into digital characteristics for malicious application detection.(iv)
The experimental results show that the accuracy rate of the semantic analysis-based classification method is 91.65%. The accuracy rate of the malware detection method is 92.17%, and this method only requires 0.1256 seconds to detect a single sample on average, which is 60.94% less than the traditional detection method.


## 2. Related Works

The classification methods of Android applications are mainly divided into two types: manual classification and automatic classification. The manual classification method determines the application’s basic functions by the application store staff through the application’s trial run; thereby, the application’s label can be determined. This method’s operation complexity is low, but the time cost and labor costs are enormous, and the error rate is inevitable.Automatic classification is the process that the classifier model reads and analyzes the code file or other useful information of the application to determine the application’s category according to the predefined category label set. Compared with the manual classification method, the automatic classification method, with the help of powerful computing and storage capacity of the computer, eliminates manual trial operation and simulated interactive operation, which dramatically improves application category determination efficiency. The application category automatic determination method is mainly aimed to find the key features in the static code files of Android applications for processing and analysis, which is also called the static analysis method. Burguera et al. [3] parsed the Android application software package to extract static features, combined them with the APK folder’s size, thus can perform feature filtering and fusion to form joint features for classification. After that, the joint features are formed for classification. Yuan et al. [4] parsed and decompiled the APK file, extracted the API call information and the string as features for classification. However, decompiling the APK file of the software package to extract features for classification requires a long work cycle, which affects the classification efficiency. Kutlay and Karaduzovic-Hadziabdic [5] and Ahmad et al. [6] both used static analysis to extract features and construct classifiers for classification through machine-learning algorithms. However, these methods usually use an unsupervised learning clustering algorithm to construct classifiers, dividing the static features into several clusters, not determining the specific category label in the Android App store.Several methods have been proposed for Android malware detection, including dynamic analysis, static analysis, and hybrid analysis. Each method has its merits and shortcomings.Dynamic analysis refers to the methods that deploy the application on the emulator or actual device to execute it entirely. Simulating the interaction between users and applications can determine whether there is any malicious behavior [7, 8]. Wu et al. [7] used the system call frequency and system call dependence to construct joint features for malicious detection, and the accuracy rate was 93%. Jeon et al. [8] performed dynamic analysis on malware to extract related malicious behaviors such as system calls. They used them as a basis for discrimination to compare the application’s behavior data to be tested, determining the application’s malicious degree. Although these malware detection methods based on dynamic analysis have high accuracy, they cannot be widely used because of the difficulty of execution and high cost of time.The static analysis method realizes detection by analyzing the application’s static code and does not need to run the application entirely. Because of omitting the running process, the static analysis method consumes fewer hardware resources and time, so it is a relatively efficient and fast detection method. Lindorfer et al. [9] combined the permission request information of the application with the sensitive API call information to form a joint feature for malicious detection. Guen et al. [10] extracted seven functions from the APK file by analyzing the list file and DEX file. These functions enrich the extracted information to express the application’s characteristics to investigate whether the application under test has malicious behavior. However, these methods ignore the influence of application category on the accuracy, that is, the legality of the same permission request information is different in different types of applications. Besides, static analysis methods are hard to defend against obfuscation and repackaging.Hybrid analysis refers to the combination of static analysis and dynamic analysis for malicious application detection. Therefore, hybrid analysis has the advantages of both. This method analyzes the APK folder of the Android application package and various application runtime behaviors, which is considered a comprehensive analysis method. However, the hybrid analysis also inherits the apparent disadvantages of dynamic analysis, which will lead to excessive consumption of Android system resources and a large amount of time waste [11].In summary, dynamic analysis, static analysis, and hybrid analysis all have certain drawbacks, and they are not suitable for large-scale malware detection in the Android application market.


## 3. Detection Methodology

The process of android malware detection based on permission sensitivity is illustrated in Figure1, and the details are provided as follows:(i)
Data set preprocessing: The data set preprocessing includes two parts. One is to obtain the application category label; the other is to obtain the application permission invocation information. The category label of the application is determined by the semantic analysis based on the application description text. The permission call information is gathered by decompiling the APK file of the Android application installation package and parsing the relevant files.(ii)
Permission feature processing: Permission feature processing consists of two parts, the extraction of sensitive permission feature set and the feature quantification based on the weight allocation method, which is convenient for inputting the classifier model training. The acquisition of the sensitive permission feature set is obtained by filtering permission features and permission combination features based on permission sensitivity. The feature quantification is based on the weight allocation method, which quantifies the application sensitive permission request information into the digital features to measure the application’s malicious degree.(iii)
Classifier model construction: The classifier model is constructed based on the appropriate machine-learning algorithm. The malicious detection of the application under test is completed by training sensitive digital features.Figure 1
Malicious application detection process.


### 3.1. Permission Sensitivity

The permission features and permission combination features are filtered based on the permission sensitivity in detecting malicious applications. A representative set of sensitive permission features is obtained for each type of application. Besides, to accurately represent the distinguishing strength of different permissions on malicious applications, the feature set is divided into two categories corresponding to the permission sensitivity, namely, lost permission and overload permission. In this way, different weights are assigned to the two types of permissions based on the weight allocation method, realizing the quantification of sensitive permissions. For the permission setPer = Per1, Per2,…, Perk, there are the following definitions:


#### 3.1.1. Permission Matrix

For the permission call information of a single application sample under the category label, the permission vector is obtained by comparing it with the permission set:(1)PVtij⟶=pv1,pv2,…,pvkT.Each position in the vector can only take 0 or 1. The value of 0 means that the application does not call the permission of the corresponding position in the permission set. Otherwise, the value is 1. The permission matrix is obtained by multiplying the permission vector with its transposition matrix:(2)PMtij=PVtij⟶×PVtij⟶T=pmmn0≤m≤k,0≤n≤k.The value of each position in the permission matrix is 0 or 1. pmii (0 ≤ i ≤ k) on the diagonal line of the matrix represents the request status of the permission feature with the sample application. The value of 1 means that the application has called the ith position permission in the set Per, otherwise, the value is 0. pmij (0 ≤ i ≤ k, 0 ≤ j ≤ k, i ≠ j) on the nondiagonal position of the matrix indicates the invocation of the combination of the ith permission and the jth permission feature in the sample application. A value of 0 means that the application does not call the permission combination, and a value of 1 means that the sample application calls the permission combination.


#### 3.1.2. Average Permission Matrix

The average permission matrix of benign applications underti category label is obtained by summing the permission matrix of all benign applications under ti category label and dividing by the total number of benign applications:(3)PMtiB¯=∑j=1sizetiBPMtiBjsizetiB.The average permission matrix of malicious samples is obtained by the same operation:(4)PMtiM¯=∑j=1sizetiMPMtiMjsizetiM,size (x) is a function used to calculate the number of elements in the set x. The number in each position of the average permission matrix represents the call frequency of permission features or combination features.


#### 3.1.3. Permission Sensitivity

The average permission matrix of benign samples based onti category label is subtracted from that of malicious samples to get the permission sensitivity matrix under the category label. The value of each position in the matrix is the permission sensitivity (PS). Permission sensitivity is a physical quantity to measure the degree of distinguishing between malicious and benign applications. Under the category label ti, the permission sensitivity of the permission feature m, and the permission sensitivity of the combination feature of permission m and permission n, are respectively expressed as follows:(5)PStimm=PMtiBmm¯−PMtiMmm¯,0≤m≤k,(6)PStimn=PMtiBmn¯−PMtiMmn¯,0≤m≤k,0≤n≤k,m≤n.The greater the absolute value of the feature’s permission sensitivity, the greater the discrimination between benign and malicious applications. For each type of application, permission features and combination features can be filtered to eliminate the redundant features to obtain the sensitive permission feature set based on the permission sensitivity. At the same time, to accurately quantify the application of the sensitive permission feature set, the sensitive permission feature set is further subdivided based on the permission sensitivity, and different types of features are given different weights, which can effectively represent the discriminate strength of features against malicious samples.


### 3.2. Automatic Classification Based on Semantic Analysis

The same permission request has different legality judgments in various applications, so it is necessary to classify applications to detect malicious applications.Semantic analysis is used to extract the category label based on application description text. Before submitting an application package to the app store for release, the developer must fill in the application function description text, publisher, and other relevant information. The filling of this information is directly related to the publisher’s digital signature. It will be reviewed by the staff of the app store, which has high credibility and authenticity. The specific steps are shown in Figure2.Figure 2
Process of application category determination based on semantic analysis.The Android application description text obtained by web crawler technology usually contains null characters, special meaning symbols, and so on, which disturb the semantic analysis. It is necessary to use Unicode encoding and other methods to preprocess the application description text to reduce noise. Simultaneously, to classify applications based on description text, it is necessary to predefine the set of category labels.The preprocessed text set needs to be extracted with feature words. The Term Frequency-Inverse Document Frequency algorithm (TF-IDF) does not involve iterative calculation and word comparison, which saves hardware memory space and extraction time. The effect of feature word extraction is very prominent. Therefore, the TF-IDF algorithm is used to extract feature words from the description text of each type of application [12]. Algorithm 1 gives its pseudocode.Algorithm 1: Feature word set extraction algorithm of description text based on TF-IDF.
Input:T is the label collection, D is the application description text collectionOutput: Feature word collection Words1: initialize an Array of Words2:for each ti ∈ Tdo3:  initialize a mapMapti4:  initialize an array docij5:for each appij ∈ tido6:   docij = pretreatment (Dij)7:   wordsij ⟵ TF − IDF (docij)8:for each wordk ∈ words do9:if wordk ∈ Maptithen10:valuewordk⟵valuewordk+111:elseMapti.push (key: wordk, value: 1)12:end if13:end for14:end for15:  Words.push (Mapti)16:end for17:return WordsIn order to process the relationship between a single feature word and a set of feature words into useful features that can be recognized and read by a machine-learning algorithm, it is necessary to quantize the feature words so that the text information can be transformed into a meaningful number vector or array [13]. Bag of words (BOW) is the most common method of word vectorization. Its main idea is to take a high-order vector whose dimension is equal to the size of the feature word set, and each position of the vector represents the number of times the corresponding word appears in the word set [14]. The word bag model considers the influence of the occurrence times of feature words on feature vectors. However, due to the uncertainty of the number and frequency of feature words in a single text, the difference between feature vectors in various texts is too high. The complexity of the subsequent calculation is significantly increased. Therefore, the bag of words model is improved: use the normalized exponential function to process the digital vector based on the bag-of-words model so that the sum of all the digits of the vector is equal to 1. The specific process is as follows:The extracted feature word set is Words, and the set size isn. Comparing the feature words extracted by a specific application description text d with the feature word set, the vector can be obtained using the bag of words model:(7)Vd⟶=v1,v2,…,vnT.Use the exponential function to normalize the vector:(8)Vsi=evi∑j=1nevj.The normalized vector is(9)Vsd⟶=vs1,vs2,…,vsnT.In this way, the feature words can be converted into digital vectors, which can then be input into the classifier model for training and predicting category labels.


### 3.3. Extraction of Sensitive Permission Feature Set

In order to reduce the detection time and save memory space, the permission features and combination features are filtered based on the permission sensitivity to obtain the sensitive permission feature set based on the category label.The Android operating system initially designed more than 400 permissions for developers to use. Some permissions can only be called by the system, and ordinary developers have no right to use them. This type of permission is the first to eliminate in the study. Simultaneously, in the latest version of the Android log, it was mentioned that some permissions will rarely be used by the regular application and will be discarded in future versions, such as the SET_PREFERRED_APPLICATIONS permission, so these permissions are filtered. UsePer = {Per1, Per2, …, Perk} to indicate the remaining set of permissions after filtering.The benign application samplesBti and malicious application samples Mti under the label ti are obtained from the public data set. Related operations such as decompiling the APK file are carried out to get the application’s permission call information. For a single application sample appij under the ti category label, the binary permission vector PVtij⟶ is obtained by comparing the permission call information with the permission set.The transposition vector of the feature vector is denoted asPVtijT, according to formula (2), the feature matrix PMtij of k × k dimension is obtained by multiplying with PVtij⟶.According to formulas (3) and (4), the average permission matrix PMtiB⟶ of benign samples and the average permission matrix PMtiM⟶ of malicious samples can be calculated. The diagonal number in the average permission matrix represents the permission coverage of the corresponding permission feature. The nondiagonal number represents the permission coverage of the corresponding permission combination feature. Permission coverage is a measure of the frequency of calling a specific permission feature or permission combination feature under a single category.When the average permission matrix of benign application samples is subtracted from that of malicious application samples under theti category label, the value is the permission sensitivity of corresponding features. According to formula (5), PStimm, the sensitivity of permission feature m to malicious samples and benign samples can be calculated. According to formula (6), PStimn, the sensitivity of permission combination features of permission m and permission n under the ti category label can be calculated.The permission sensitivity indicates the ability of the feature to distinguish between benign and malicious applications. The higher the absolute value of permission sensitivity, the more pronounced the discrimination between benign and malicious applications. Therefore, for all the permission features and permission combination features under theti category label, the permission sensitivity x1, x2,…, xn is arranged from large to small according to the absolute value. Set threshold μ:(10)μ=minx∑j=1nx−xj2n−12.The features whose absolute value of permission sensitivity is greater than or equal to the threshold are put into the sensitive permission feature set, which means the permission feature can distinguish benign and malicious applications more effectively to increase the detection accuracy. If the absolute value of the permission sensitivity is less than the threshold value, the feature which wastes time and space resources will be eliminated. When faced with conflicts between permission features and permission combination features, the permission combination features are considered to be more effective in distinguishing malicious and benign, and the permission combination features are added to the sensitive permission feature set, while the permission features are discarded, and the sensitive permission feature set of theti category label is obtained. After repeated operations, the sensitive permission feature set corresponding to all category labels can be obtained.


### 3.4. Quantification of Sensitive Permission

The permission request information of the application to be tested is compared with the sensitive permission feature set based on the category label. The result is represented by digital features, which better reflects the malicious degree of the application. This process is the quantification of sensitive permission features.In traditional malware detection methods, binary methods are usually used to process features. Use 0 to indicate that the permission is not invoked, and 1 indicates that the permission is invoked. Thus the high-dimensional vectors of 0 and 1 are formed and input into the classifier. But the binary method has apparent shortcomings, for the permission group set per, assuming that the sensitivity of permissioni is greater than that of j, it means that the distinguishing power of permission feature i for malicious and benign samples is higher than that of permission feature j. If expressed by the binary method, their corresponding positions will be assigned as 1 or 0, which cannot reflect the degree of distinguishing malicious and benign applications. The neglect of the relationship will affect the detection results, so the weight allocation method is proposed to quantify the features.First, two types of permissions are defined: lost permission and overload permission.


#### 3.4.1. Lost Permission

When calculating the permission sensitivity, the values are positive and negative. When the permission sensitivity of features is positive, under the category label, the permission coverage of benign application samples is greater than that of malicious application samples. Such features are defined as lost permissions (LP). Under the category label, the probability that the permission featurej appears in the benign application sample is higher than that in the malicious application sample. The benign application usually calls the permission feature j, while the malicious application rarely calls the permission feature j, which is the lost permission.


#### 3.4.2. Overload Permission

The permission features with negative permission sensitivity under the same category label. That means the probability of permission featurej appearing in the malicious application sample is higher than that in the benign application sample. The malicious application usually calls permission feature j, while benign application rarely calls permission feature j, which is overload permission.Sensitive permissions are divided into two categories because they have different influences on malware detection. The lost permission means that the application under test does not call one or more key permission features than benign applications. For example, a photographing application does not apply for calling camera permission. Under normal circumstances, it can be considered that the application under test may not have the normal functions of other applications under the category label. Still, there will be no other malicious behavior. Overload permission means that the application under test calls one or more key permission features, such as a shopping application calling contact information, compared with the benign application. This extra behavior should be considered as malicious behavior beyond the acceptable range. Therefore, the discrimination between malicious and benign of the overload permission should be higher than that of the lost permission. Whenα and β are used to measure the discrimination of overload permission and the lost permission for malicious samples, α ≥ β.The main disadvantage of the binary method is that it cannot reflect the difference in permission sensitivity. Therefore, all permission features under the label are normalized according to the sensitivity. Each permission feature is assigned a weight to measure the ability to distinguish benign and malicious application samples. Assuming that the sensitive permission feature set based on theti category label is (P1,PSti1), (P2,PSti2),…, (Pn,PStin), where P is the specific permission, and PS represents the sensitivity of the permission. For permission Pk, the weight can be calculated as follows:(11)wk=PStik∑m=1nPStim.For all features in the sensitive permission feature set, the weight vectorW is obtained:(12)W⟶=w1,w2,…,wnT.Combining overload permissions and lost permissions, the above formula is further processed:(13)PW⟶=pw1,pw2,…,pwnT,pwi=wi×α,pi∈OP,wi×β,pi∈LP.Assuming that the application permission call vector obtained by the binary method isBini⟶, then the digital feature obtained by the weight distribution method is(14)Wi=Bini⟶⋅PW⟶.The pseudocode of the specific weight allocation algorithm is shown in Algorithm2.Algorithm 2: The indication of sensitive permission call information based on the weight allocation method.
Input: Test is the application to be testedOutput: The weight of permission1:for each app ∈ Test do2:   initialize a value result = 03:   Binapp ⟵ Binary (app)4:for each i ∈ PSGroupsdo5:Wi ⟵ Normalized (Wi)6:ifi ∈ LP then7:     result ⟵ result +Binappi ∗ Wi ∗ α8:else9:     result ⟵ result +Binappi ∗ Wi ∗ β10:end if11:end for12:return result13:end for


### 3.5. Construction of Classifier Model for Malware Detection

A classifier is constructed to process the digitized sensitive features to complete the malware detection based on the machine-learning algorithm. Among the most commonly used traditional machine-learning algorithms, the random forest algorithm has excellent performance compared to other traditional machine-learning algorithms [15]. It takes less time to process large-scale samples. Therefore, the random forest algorithm is used to construct a classifier model for Android malware detection. The detailed process is shown in Algorithm 3.Algorithm 3: Construct a classifier based on the random forest algorithm to perform malware detection.
Input: data is the sample data set,s is the data set extraction ratio, DT is the decision tree collection, x is the attribute classification methodOutput: result Malware detection result1:  initialize a valuenumb2:  initialize a valuenumm3:for each dt∈DTdo4:   initialize a Boolean temp5:datadt⟵data∗s6:temp⟵DTdatadt,x7:if temp = true then8:numb⟵numb+19:end if10:if temp = false then11:numm⟵numm+112:end if13:end for14:ifnumb>nummthen15:result⟵Benign16:end if17:ifnumb<nummthen18:result⟵Malicious19:end if20:return result


## 3.1. Permission Sensitivity

The permission features and permission combination features are filtered based on the permission sensitivity in detecting malicious applications. A representative set of sensitive permission features is obtained for each type of application. Besides, to accurately represent the distinguishing strength of different permissions on malicious applications, the feature set is divided into two categories corresponding to the permission sensitivity, namely, lost permission and overload permission. In this way, different weights are assigned to the two types of permissions based on the weight allocation method, realizing the quantification of sensitive permissions. For the permission setPer = Per1, Per2,…, Perk, there are the following definitions:


### 3.1.1. Permission Matrix

For the permission call information of a single application sample under the category label, the permission vector is obtained by comparing it with the permission set:(1)PVtij⟶=pv1,pv2,…,pvkT.Each position in the vector can only take 0 or 1. The value of 0 means that the application does not call the permission of the corresponding position in the permission set. Otherwise, the value is 1. The permission matrix is obtained by multiplying the permission vector with its transposition matrix:(2)PMtij=PVtij⟶×PVtij⟶T=pmmn0≤m≤k,0≤n≤k.The value of each position in the permission matrix is 0 or 1. pmii (0 ≤ i ≤ k) on the diagonal line of the matrix represents the request status of the permission feature with the sample application. The value of 1 means that the application has called the ith position permission in the set Per, otherwise, the value is 0. pmij (0 ≤ i ≤ k, 0 ≤ j ≤ k, i ≠ j) on the nondiagonal position of the matrix indicates the invocation of the combination of the ith permission and the jth permission feature in the sample application. A value of 0 means that the application does not call the permission combination, and a value of 1 means that the sample application calls the permission combination.


### 3.1.2. Average Permission Matrix

The average permission matrix of benign applications underti category label is obtained by summing the permission matrix of all benign applications under ti category label and dividing by the total number of benign applications:(3)PMtiB¯=∑j=1sizetiBPMtiBjsizetiB.The average permission matrix of malicious samples is obtained by the same operation:(4)PMtiM¯=∑j=1sizetiMPMtiMjsizetiM,size (x) is a function used to calculate the number of elements in the set x. The number in each position of the average permission matrix represents the call frequency of permission features or combination features.


### 3.1.3. Permission Sensitivity

The average permission matrix of benign samples based onti category label is subtracted from that of malicious samples to get the permission sensitivity matrix under the category label. The value of each position in the matrix is the permission sensitivity (PS). Permission sensitivity is a physical quantity to measure the degree of distinguishing between malicious and benign applications. Under the category label ti, the permission sensitivity of the permission feature m, and the permission sensitivity of the combination feature of permission m and permission n, are respectively expressed as follows:(5)PStimm=PMtiBmm¯−PMtiMmm¯,0≤m≤k,(6)PStimn=PMtiBmn¯−PMtiMmn¯,0≤m≤k,0≤n≤k,m≤n.The greater the absolute value of the feature’s permission sensitivity, the greater the discrimination between benign and malicious applications. For each type of application, permission features and combination features can be filtered to eliminate the redundant features to obtain the sensitive permission feature set based on the permission sensitivity. At the same time, to accurately quantify the application of the sensitive permission feature set, the sensitive permission feature set is further subdivided based on the permission sensitivity, and different types of features are given different weights, which can effectively represent the discriminate strength of features against malicious samples.


## 3.1.1. Permission Matrix

For the permission call information of a single application sample under the category label, the permission vector is obtained by comparing it with the permission set:(1)PVtij⟶=pv1,pv2,…,pvkT.Each position in the vector can only take 0 or 1. The value of 0 means that the application does not call the permission of the corresponding position in the permission set. Otherwise, the value is 1. The permission matrix is obtained by multiplying the permission vector with its transposition matrix:(2)PMtij=PVtij⟶×PVtij⟶T=pmmn0≤m≤k,0≤n≤k.The value of each position in the permission matrix is 0 or 1. pmii (0 ≤ i ≤ k) on the diagonal line of the matrix represents the request status of the permission feature with the sample application. The value of 1 means that the application has called the ith position permission in the set Per, otherwise, the value is 0. pmij (0 ≤ i ≤ k, 0 ≤ j ≤ k, i ≠ j) on the nondiagonal position of the matrix indicates the invocation of the combination of the ith permission and the jth permission feature in the sample application. A value of 0 means that the application does not call the permission combination, and a value of 1 means that the sample application calls the permission combination.


## 3.1.2. Average Permission Matrix

The average permission matrix of benign applications underti category label is obtained by summing the permission matrix of all benign applications under ti category label and dividing by the total number of benign applications:(3)PMtiB¯=∑j=1sizetiBPMtiBjsizetiB.The average permission matrix of malicious samples is obtained by the same operation:(4)PMtiM¯=∑j=1sizetiMPMtiMjsizetiM,size (x) is a function used to calculate the number of elements in the set x. The number in each position of the average permission matrix represents the call frequency of permission features or combination features.


## 3.1.3. Permission Sensitivity

The average permission matrix of benign samples based onti category label is subtracted from that of malicious samples to get the permission sensitivity matrix under the category label. The value of each position in the matrix is the permission sensitivity (PS). Permission sensitivity is a physical quantity to measure the degree of distinguishing between malicious and benign applications. Under the category label ti, the permission sensitivity of the permission feature m, and the permission sensitivity of the combination feature of permission m and permission n, are respectively expressed as follows:(5)PStimm=PMtiBmm¯−PMtiMmm¯,0≤m≤k,(6)PStimn=PMtiBmn¯−PMtiMmn¯,0≤m≤k,0≤n≤k,m≤n.The greater the absolute value of the feature’s permission sensitivity, the greater the discrimination between benign and malicious applications. For each type of application, permission features and combination features can be filtered to eliminate the redundant features to obtain the sensitive permission feature set based on the permission sensitivity. At the same time, to accurately quantify the application of the sensitive permission feature set, the sensitive permission feature set is further subdivided based on the permission sensitivity, and different types of features are given different weights, which can effectively represent the discriminate strength of features against malicious samples.


## 3.2. Automatic Classification Based on Semantic Analysis

The same permission request has different legality judgments in various applications, so it is necessary to classify applications to detect malicious applications.Semantic analysis is used to extract the category label based on application description text. Before submitting an application package to the app store for release, the developer must fill in the application function description text, publisher, and other relevant information. The filling of this information is directly related to the publisher’s digital signature. It will be reviewed by the staff of the app store, which has high credibility and authenticity. The specific steps are shown in Figure2.Figure 2
Process of application category determination based on semantic analysis.The Android application description text obtained by web crawler technology usually contains null characters, special meaning symbols, and so on, which disturb the semantic analysis. It is necessary to use Unicode encoding and other methods to preprocess the application description text to reduce noise. Simultaneously, to classify applications based on description text, it is necessary to predefine the set of category labels.The preprocessed text set needs to be extracted with feature words. The Term Frequency-Inverse Document Frequency algorithm (TF-IDF) does not involve iterative calculation and word comparison, which saves hardware memory space and extraction time. The effect of feature word extraction is very prominent. Therefore, the TF-IDF algorithm is used to extract feature words from the description text of each type of application [12]. Algorithm 1 gives its pseudocode.Algorithm 1: Feature word set extraction algorithm of description text based on TF-IDF.
Input:T is the label collection, D is the application description text collectionOutput: Feature word collection Words1: initialize an Array of Words2:for each ti ∈ Tdo3:  initialize a mapMapti4:  initialize an array docij5:for each appij ∈ tido6:   docij = pretreatment (Dij)7:   wordsij ⟵ TF − IDF (docij)8:for each wordk ∈ words do9:if wordk ∈ Maptithen10:valuewordk⟵valuewordk+111:elseMapti.push (key: wordk, value: 1)12:end if13:end for14:end for15:  Words.push (Mapti)16:end for17:return WordsIn order to process the relationship between a single feature word and a set of feature words into useful features that can be recognized and read by a machine-learning algorithm, it is necessary to quantize the feature words so that the text information can be transformed into a meaningful number vector or array [13]. Bag of words (BOW) is the most common method of word vectorization. Its main idea is to take a high-order vector whose dimension is equal to the size of the feature word set, and each position of the vector represents the number of times the corresponding word appears in the word set [14]. The word bag model considers the influence of the occurrence times of feature words on feature vectors. However, due to the uncertainty of the number and frequency of feature words in a single text, the difference between feature vectors in various texts is too high. The complexity of the subsequent calculation is significantly increased. Therefore, the bag of words model is improved: use the normalized exponential function to process the digital vector based on the bag-of-words model so that the sum of all the digits of the vector is equal to 1. The specific process is as follows:The extracted feature word set is Words, and the set size isn. Comparing the feature words extracted by a specific application description text d with the feature word set, the vector can be obtained using the bag of words model:(7)Vd⟶=v1,v2,…,vnT.Use the exponential function to normalize the vector:(8)Vsi=evi∑j=1nevj.The normalized vector is(9)Vsd⟶=vs1,vs2,…,vsnT.In this way, the feature words can be converted into digital vectors, which can then be input into the classifier model for training and predicting category labels.


## 3.3. Extraction of Sensitive Permission Feature Set

In order to reduce the detection time and save memory space, the permission features and combination features are filtered based on the permission sensitivity to obtain the sensitive permission feature set based on the category label.The Android operating system initially designed more than 400 permissions for developers to use. Some permissions can only be called by the system, and ordinary developers have no right to use them. This type of permission is the first to eliminate in the study. Simultaneously, in the latest version of the Android log, it was mentioned that some permissions will rarely be used by the regular application and will be discarded in future versions, such as the SET_PREFERRED_APPLICATIONS permission, so these permissions are filtered. UsePer = {Per1, Per2, …, Perk} to indicate the remaining set of permissions after filtering.The benign application samplesBti and malicious application samples Mti under the label ti are obtained from the public data set. Related operations such as decompiling the APK file are carried out to get the application’s permission call information. For a single application sample appij under the ti category label, the binary permission vector PVtij⟶ is obtained by comparing the permission call information with the permission set.The transposition vector of the feature vector is denoted asPVtijT, according to formula (2), the feature matrix PMtij of k × k dimension is obtained by multiplying with PVtij⟶.According to formulas (3) and (4), the average permission matrix PMtiB⟶ of benign samples and the average permission matrix PMtiM⟶ of malicious samples can be calculated. The diagonal number in the average permission matrix represents the permission coverage of the corresponding permission feature. The nondiagonal number represents the permission coverage of the corresponding permission combination feature. Permission coverage is a measure of the frequency of calling a specific permission feature or permission combination feature under a single category.When the average permission matrix of benign application samples is subtracted from that of malicious application samples under theti category label, the value is the permission sensitivity of corresponding features. According to formula (5), PStimm, the sensitivity of permission feature m to malicious samples and benign samples can be calculated. According to formula (6), PStimn, the sensitivity of permission combination features of permission m and permission n under the ti category label can be calculated.The permission sensitivity indicates the ability of the feature to distinguish between benign and malicious applications. The higher the absolute value of permission sensitivity, the more pronounced the discrimination between benign and malicious applications. Therefore, for all the permission features and permission combination features under theti category label, the permission sensitivity x1, x2,…, xn is arranged from large to small according to the absolute value. Set threshold μ:(10)μ=minx∑j=1nx−xj2n−12.The features whose absolute value of permission sensitivity is greater than or equal to the threshold are put into the sensitive permission feature set, which means the permission feature can distinguish benign and malicious applications more effectively to increase the detection accuracy. If the absolute value of the permission sensitivity is less than the threshold value, the feature which wastes time and space resources will be eliminated. When faced with conflicts between permission features and permission combination features, the permission combination features are considered to be more effective in distinguishing malicious and benign, and the permission combination features are added to the sensitive permission feature set, while the permission features are discarded, and the sensitive permission feature set of theti category label is obtained. After repeated operations, the sensitive permission feature set corresponding to all category labels can be obtained.


## 3.4. Quantification of Sensitive Permission

The permission request information of the application to be tested is compared with the sensitive permission feature set based on the category label. The result is represented by digital features, which better reflects the malicious degree of the application. This process is the quantification of sensitive permission features.In traditional malware detection methods, binary methods are usually used to process features. Use 0 to indicate that the permission is not invoked, and 1 indicates that the permission is invoked. Thus the high-dimensional vectors of 0 and 1 are formed and input into the classifier. But the binary method has apparent shortcomings, for the permission group set per, assuming that the sensitivity of permissioni is greater than that of j, it means that the distinguishing power of permission feature i for malicious and benign samples is higher than that of permission feature j. If expressed by the binary method, their corresponding positions will be assigned as 1 or 0, which cannot reflect the degree of distinguishing malicious and benign applications. The neglect of the relationship will affect the detection results, so the weight allocation method is proposed to quantify the features.First, two types of permissions are defined: lost permission and overload permission.


### 3.4.1. Lost Permission

When calculating the permission sensitivity, the values are positive and negative. When the permission sensitivity of features is positive, under the category label, the permission coverage of benign application samples is greater than that of malicious application samples. Such features are defined as lost permissions (LP). Under the category label, the probability that the permission featurej appears in the benign application sample is higher than that in the malicious application sample. The benign application usually calls the permission feature j, while the malicious application rarely calls the permission feature j, which is the lost permission.


### 3.4.2. Overload Permission

The permission features with negative permission sensitivity under the same category label. That means the probability of permission featurej appearing in the malicious application sample is higher than that in the benign application sample. The malicious application usually calls permission feature j, while benign application rarely calls permission feature j, which is overload permission.Sensitive permissions are divided into two categories because they have different influences on malware detection. The lost permission means that the application under test does not call one or more key permission features than benign applications. For example, a photographing application does not apply for calling camera permission. Under normal circumstances, it can be considered that the application under test may not have the normal functions of other applications under the category label. Still, there will be no other malicious behavior. Overload permission means that the application under test calls one or more key permission features, such as a shopping application calling contact information, compared with the benign application. This extra behavior should be considered as malicious behavior beyond the acceptable range. Therefore, the discrimination between malicious and benign of the overload permission should be higher than that of the lost permission. Whenα and β are used to measure the discrimination of overload permission and the lost permission for malicious samples, α ≥ β.The main disadvantage of the binary method is that it cannot reflect the difference in permission sensitivity. Therefore, all permission features under the label are normalized according to the sensitivity. Each permission feature is assigned a weight to measure the ability to distinguish benign and malicious application samples. Assuming that the sensitive permission feature set based on theti category label is (P1,PSti1), (P2,PSti2),…, (Pn,PStin), where P is the specific permission, and PS represents the sensitivity of the permission. For permission Pk, the weight can be calculated as follows:(11)wk=PStik∑m=1nPStim.For all features in the sensitive permission feature set, the weight vectorW is obtained:(12)W⟶=w1,w2,…,wnT.Combining overload permissions and lost permissions, the above formula is further processed:(13)PW⟶=pw1,pw2,…,pwnT,pwi=wi×α,pi∈OP,wi×β,pi∈LP.Assuming that the application permission call vector obtained by the binary method isBini⟶, then the digital feature obtained by the weight distribution method is(14)Wi=Bini⟶⋅PW⟶.The pseudocode of the specific weight allocation algorithm is shown in Algorithm2.Algorithm 2: The indication of sensitive permission call information based on the weight allocation method.
Input: Test is the application to be testedOutput: The weight of permission1:for each app ∈ Test do2:   initialize a value result = 03:   Binapp ⟵ Binary (app)4:for each i ∈ PSGroupsdo5:Wi ⟵ Normalized (Wi)6:ifi ∈ LP then7:     result ⟵ result +Binappi ∗ Wi ∗ α8:else9:     result ⟵ result +Binappi ∗ Wi ∗ β10:end if11:end for12:return result13:end for


## 3.4.1. Lost Permission

When calculating the permission sensitivity, the values are positive and negative. When the permission sensitivity of features is positive, under the category label, the permission coverage of benign application samples is greater than that of malicious application samples. Such features are defined as lost permissions (LP). Under the category label, the probability that the permission featurej appears in the benign application sample is higher than that in the malicious application sample. The benign application usually calls the permission feature j, while the malicious application rarely calls the permission feature j, which is the lost permission.


## 3.4.2. Overload Permission

The permission features with negative permission sensitivity under the same category label. That means the probability of permission featurej appearing in the malicious application sample is higher than that in the benign application sample. The malicious application usually calls permission feature j, while benign application rarely calls permission feature j, which is overload permission.Sensitive permissions are divided into two categories because they have different influences on malware detection. The lost permission means that the application under test does not call one or more key permission features than benign applications. For example, a photographing application does not apply for calling camera permission. Under normal circumstances, it can be considered that the application under test may not have the normal functions of other applications under the category label. Still, there will be no other malicious behavior. Overload permission means that the application under test calls one or more key permission features, such as a shopping application calling contact information, compared with the benign application. This extra behavior should be considered as malicious behavior beyond the acceptable range. Therefore, the discrimination between malicious and benign of the overload permission should be higher than that of the lost permission. Whenα and β are used to measure the discrimination of overload permission and the lost permission for malicious samples, α ≥ β.The main disadvantage of the binary method is that it cannot reflect the difference in permission sensitivity. Therefore, all permission features under the label are normalized according to the sensitivity. Each permission feature is assigned a weight to measure the ability to distinguish benign and malicious application samples. Assuming that the sensitive permission feature set based on theti category label is (P1,PSti1), (P2,PSti2),…, (Pn,PStin), where P is the specific permission, and PS represents the sensitivity of the permission. For permission Pk, the weight can be calculated as follows:(11)wk=PStik∑m=1nPStim.For all features in the sensitive permission feature set, the weight vectorW is obtained:(12)W⟶=w1,w2,…,wnT.Combining overload permissions and lost permissions, the above formula is further processed:(13)PW⟶=pw1,pw2,…,pwnT,pwi=wi×α,pi∈OP,wi×β,pi∈LP.Assuming that the application permission call vector obtained by the binary method isBini⟶, then the digital feature obtained by the weight distribution method is(14)Wi=Bini⟶⋅PW⟶.The pseudocode of the specific weight allocation algorithm is shown in Algorithm2.Algorithm 2: The indication of sensitive permission call information based on the weight allocation method.
Input: Test is the application to be testedOutput: The weight of permission1:for each app ∈ Test do2:   initialize a value result = 03:   Binapp ⟵ Binary (app)4:for each i ∈ PSGroupsdo5:Wi ⟵ Normalized (Wi)6:ifi ∈ LP then7:     result ⟵ result +Binappi ∗ Wi ∗ α8:else9:     result ⟵ result +Binappi ∗ Wi ∗ β10:end if11:end for12:return result13:end for


## 3.5. Construction of Classifier Model for Malware Detection

A classifier is constructed to process the digitized sensitive features to complete the malware detection based on the machine-learning algorithm. Among the most commonly used traditional machine-learning algorithms, the random forest algorithm has excellent performance compared to other traditional machine-learning algorithms [15]. It takes less time to process large-scale samples. Therefore, the random forest algorithm is used to construct a classifier model for Android malware detection. The detailed process is shown in Algorithm 3.Algorithm 3: Construct a classifier based on the random forest algorithm to perform malware detection.
Input: data is the sample data set,s is the data set extraction ratio, DT is the decision tree collection, x is the attribute classification methodOutput: result Malware detection result1:  initialize a valuenumb2:  initialize a valuenumm3:for each dt∈DTdo4:   initialize a Boolean temp5:datadt⟵data∗s6:temp⟵DTdatadt,x7:if temp = true then8:numb⟵numb+19:end if10:if temp = false then11:numm⟵numm+112:end if13:end for14:ifnumb>nummthen15:result⟵Benign16:end if17:ifnumb<nummthen18:result⟵Malicious19:end if20:return result


## 4. Experimental Results and Analysis

In this experiment, 3400 Android malicious application samples from the VirusShare [16] and Arp et al. [17] data sets, 4500 normal applications as the benign Android samples were selected from the Huawei application market through crawler technology. 80% of the samples are used as the training set, and 20% of the samples are used to test the classifier model’s performance. Before classifying the applications, the application category label set is predefined: navigation, online shopping, weather, finance, education, catering, camera, music, social, communication, news, video, reading, tourism, sports, office, tools, and game.


### 4.1. Evaluation Metrics

Suppose TP and TN are the numbers of benign applications and malicious applications correctly identified, FP and FN are the numbers of misjudged malicious applications and benign applications, respectively. Then the commonly used evaluation metrics of two classification problems are accuracyA, precision Pre, recall Rec and F1:(15)A=TP+TNTP+TN+FP+FN,Pre=TPTP+FP,Rec=TPTP+FN,F1=2×TP2×TP+FP+FN.For the multiclassification problem, the concept of macro average is introduced, and the evaluation metrics of each category label are calculated by arithmetic average: macro precisionPmacro, macro recall Rmacro, and macro F1macro to measure the performance of the detection method.(16)Pmacro=1n∑i=1nPi,Rmacro=1n∑i=1nRi,F1macro=2×Pmacro×RmacroPmacro+Rmacro.The classifier model includes two processes: training and testing. Symboltr is used to represent the time taken by the classifier to complete the sample training, the symbol tp to represent the time taken for the classifier to complete the sample test, the symbol ts to represent the total time for training and prediction, and the symbol t¯ to represent the time consumed for processing a single sample.


### 4.2. Analysis of Results

In the experiment of category label determination,k-nearest neighbor (KNN) algorithm [18], Naive Bayes Model (NBM) [19], and TextCNN algorithm [20] are used to construct classifier models for comparison. In the malware detection experiment, the value of α/β in the model is tuned. The optimized detection model is compared with the traditional detection model to check accuracy and efficiency.


#### 4.2.1.k-Nearest Neighbor Classifier

The accuracy of the classifier model constructed by thek-nearest neighbor algorithm mainly depends on two aspects: the value of k and the choice of distance calculation methods. In this experiment, these two parameters were tuned separately, and the results are shown in Figure 3.Figure 3
Experimental results of different classifiers. (a) KNN classifier with differentk values, (b) KNN classifier with different distance formulas, (c) NBM classifier under different models, and (d) performance of different classifier models.
(a)(b)(c)(d)Figure3(a) shows the evaluation metrics A, Pmacro, Rmacro, and F1macro of KNN classifier model using Euclidean distance under different k values. It can be seen that when k < 15, the performance of classifier accuracy is generally low and fluctuates significantly at that time. When k = 15, all the classifier’s evaluation indexes reached the best, which were 0.8842, 0.9016, 0.8749, and 0.8853, respectively. When k > 15, the indicators of the model declined slowly. Therefore, when k is 15, the k-nearest neighbor classifier model has the best performance.Figure3(b) shows the k-nearest neighbor classifier model’s performance results using Euclidean distance and Manhattan distance, respectively. From the graph, we can find that the A, Pmacro, Rmacro, and F1macro of the classifier using Manhattan distance formula are generally low, which is far less than the classifier’s performance using Euclidean distance under the same conditions. According to the above experimental results, when the k-nearest neighbor classifier model has the best performance, the value of k should be 15, and the distance calculation method should be Euclidean distance.


#### 4.2.2. Naive Bayes Model Classifier

The classifier model’s parameters based on the Naive Bayes Model are optimized to explore the distribution model (Bernoulli Model, Multivariate Distribution Model), which makes the accuracy performance of the classifier model the best. The results are shown in Figure3(c). It can be seen from Figure 3(c) that under the same data set, the evaluation metrics obtained using the multivariate distribution model are better than those using the Bernoulli model, which is of great help to improve the accuracy performance of the classifier.


#### 4.2.3. Performance Comparison of Three Classifier Models

TextCNN algorithm is a representative algorithm model to solve the problems of text classification and semantic analysis. Compared to thek-nearest neighbor algorithm classifier model, the Naive Bayes algorithm classifier model, and the TextCNN algorithm classifier model with the performance, the results are shown in Figure 3(d). The graph shows that the A, Pmacro, Rmacro, and F1macro of the classifier constructed based on the TextCNN algorithm are 0.9165, 0.9368, 0.8971, and 0.9127, respectively, which are better than the other two models. It can be seen that in the data sets and application scenarios of this study, the deep learning algorithm is more suitable than the traditional machine-learning algorithm in constructing a classifier model to complete the automatic application category determination based on semantic analysis.Table1 shows the performance of the three models on classification speed. It can be seen from Table 1 that in the total training and prediction time, the TextCNN classifier model with the best accuracy performance takes the most time, reaching 3688.57 seconds. In terms of the average training and prediction time of a single sample, the Naive Bayesian Model performs best, and it only takes 0.1677 seconds to process a sample. Considering that the ratio of training data set to test data set in this experiment is 4 : 1, from the approximate results, the ratio of training time to test time of classifier constructed based on Naive Bayesian algorithm is equal to the ratio of training data set to training data set, that is, the time complexity can be considered as On. Although the total time consumed by the TextCNN model is relatively large, the training and prediction time is relatively large, and the time complexity is similar to O(n). This means that when the data set is vast, the disadvantage of using the TextCNN algorithm to construct a classifier will be significantly reduced, which can even become a more efficient algorithm.Table 1
Efficiency performance of three classifier models.
trstpstsst¯sKNN2202.81339.632542.440.2472NBM1226.97308.741535.710.1677TextCNN2474.621213.953688.570.5090In summary, the accuracy of the three algorithms for application classification is above 85%. In terms of accuracy, the classification accuracy based on the TextCNN algorithm reached 91.65%, and the macro precision reached 93.68%, which is better than the other two classifier models. In terms of efficiency, the classifier model based on the Naive Bayes model takes only 0.1677 seconds to process a single sample, which is suitable for application stores with high-efficiency classification.


#### 4.2.4. Determination of Parameters in the Malware Detection Model

In quantifying sensitive permission features based on weight allocation, the ratio measures the ability of permission features to distinguish malicious and benign samples. Figure4(a) shows the results of the accuracy rate A, precision rate Pre, recall rate Rec, and F1 value of the malware detection method as the parameters αβ change. It can be seen from the figure that when the parameter is small, especially when αβ = 1, the classifier’s evaluation metrics are not ideal, and the detection accuracy of malicious applications is only 59.76%. As the parameter αβ gradually increase, each evaluation metric curve rises with a larger slope, and the detection performance is significantly improved. When αβ = 4, each evaluation metric of the classifier reaches the maximum value. Therefore, the optimal value of the αβ should be 4.Figure 4
Experimental results of malware detection. (a)α/β optimization experiment results and (b) accuracy performance results of four methods.
(a)(b)


#### 4.2.5. Performance Comparison of Four Different Malicious Detection Models

The Android malware detection method proposed in this paper is compared with the detection model without feature screening and using the binary method, the detection model with feature screening and using the binary method, and the detection model without feature screening and using the weight allocation method to compare the accuracy performance and efficiency performance of the four methods. Figure4(b) shows the results of these four methods on accuracy rate A, precision rate, recall rate, and F1 value. It can be seen from the figure that the accuracy rate of the malicious detection method proposed in this research reached 92.17%, and the precision rate reached 94.68%. It is obviously better than the other three methods in each index. Replacing the binary method with the weight allocation method, replacing the malicious application detection method by obtaining the sensitive permission feature set can increase the fine-grained of malware detection and improve malware detection accuracy.Table2 shows the efficiency performance of the above four methods in training time, prediction time, total time, and average sample time. In the case of feature screening, the weight allocation method and the binary method are almost the same in each time index. When the sensitive permission feature set is not extracted, the redundant features are too much, and the measured time is significantly increased. This shows that the method proposed in this paper successfully reduces the dimension of digital features and improves malicious detection efficiency. Compared with the traditional method of direct detection of unfiltered permission features, the proposed method reduces the time by 60.94%.Table 2
Efficiency performance of four detection models.
tr (s)tp (s)ts (s)t¯sThis research method423.2794.16517.430.1256Nonfeature screening, binary method903.75286.371190.120.3217Feature screening, binary method392.56106.12498.680.1282Nonfeature screening, weight allocation883.24230.691113.930.3012To sum up, the detection method for malicious Android applications proposed in this paper based on permission sensitivity has an accuracy rate of 92.17%, 60.94% less than the traditional detection method.


## 4.1. Evaluation Metrics

Suppose TP and TN are the numbers of benign applications and malicious applications correctly identified, FP and FN are the numbers of misjudged malicious applications and benign applications, respectively. Then the commonly used evaluation metrics of two classification problems are accuracyA, precision Pre, recall Rec and F1:(15)A=TP+TNTP+TN+FP+FN,Pre=TPTP+FP,Rec=TPTP+FN,F1=2×TP2×TP+FP+FN.For the multiclassification problem, the concept of macro average is introduced, and the evaluation metrics of each category label are calculated by arithmetic average: macro precisionPmacro, macro recall Rmacro, and macro F1macro to measure the performance of the detection method.(16)Pmacro=1n∑i=1nPi,Rmacro=1n∑i=1nRi,F1macro=2×Pmacro×RmacroPmacro+Rmacro.The classifier model includes two processes: training and testing. Symboltr is used to represent the time taken by the classifier to complete the sample training, the symbol tp to represent the time taken for the classifier to complete the sample test, the symbol ts to represent the total time for training and prediction, and the symbol t¯ to represent the time consumed for processing a single sample.


## 4.2. Analysis of Results

In the experiment of category label determination,k-nearest neighbor (KNN) algorithm [18], Naive Bayes Model (NBM) [19], and TextCNN algorithm [20] are used to construct classifier models for comparison. In the malware detection experiment, the value of α/β in the model is tuned. The optimized detection model is compared with the traditional detection model to check accuracy and efficiency.


### 4.2.1.k-Nearest Neighbor Classifier

The accuracy of the classifier model constructed by thek-nearest neighbor algorithm mainly depends on two aspects: the value of k and the choice of distance calculation methods. In this experiment, these two parameters were tuned separately, and the results are shown in Figure 3.Figure 3
Experimental results of different classifiers. (a) KNN classifier with differentk values, (b) KNN classifier with different distance formulas, (c) NBM classifier under different models, and (d) performance of different classifier models.
(a)(b)(c)(d)Figure3(a) shows the evaluation metrics A, Pmacro, Rmacro, and F1macro of KNN classifier model using Euclidean distance under different k values. It can be seen that when k < 15, the performance of classifier accuracy is generally low and fluctuates significantly at that time. When k = 15, all the classifier’s evaluation indexes reached the best, which were 0.8842, 0.9016, 0.8749, and 0.8853, respectively. When k > 15, the indicators of the model declined slowly. Therefore, when k is 15, the k-nearest neighbor classifier model has the best performance.Figure3(b) shows the k-nearest neighbor classifier model’s performance results using Euclidean distance and Manhattan distance, respectively. From the graph, we can find that the A, Pmacro, Rmacro, and F1macro of the classifier using Manhattan distance formula are generally low, which is far less than the classifier’s performance using Euclidean distance under the same conditions. According to the above experimental results, when the k-nearest neighbor classifier model has the best performance, the value of k should be 15, and the distance calculation method should be Euclidean distance.


### 4.2.2. Naive Bayes Model Classifier

The classifier model’s parameters based on the Naive Bayes Model are optimized to explore the distribution model (Bernoulli Model, Multivariate Distribution Model), which makes the accuracy performance of the classifier model the best. The results are shown in Figure3(c). It can be seen from Figure 3(c) that under the same data set, the evaluation metrics obtained using the multivariate distribution model are better than those using the Bernoulli model, which is of great help to improve the accuracy performance of the classifier.


### 4.2.3. Performance Comparison of Three Classifier Models

TextCNN algorithm is a representative algorithm model to solve the problems of text classification and semantic analysis. Compared to thek-nearest neighbor algorithm classifier model, the Naive Bayes algorithm classifier model, and the TextCNN algorithm classifier model with the performance, the results are shown in Figure 3(d). The graph shows that the A, Pmacro, Rmacro, and F1macro of the classifier constructed based on the TextCNN algorithm are 0.9165, 0.9368, 0.8971, and 0.9127, respectively, which are better than the other two models. It can be seen that in the data sets and application scenarios of this study, the deep learning algorithm is more suitable than the traditional machine-learning algorithm in constructing a classifier model to complete the automatic application category determination based on semantic analysis.Table1 shows the performance of the three models on classification speed. It can be seen from Table 1 that in the total training and prediction time, the TextCNN classifier model with the best accuracy performance takes the most time, reaching 3688.57 seconds. In terms of the average training and prediction time of a single sample, the Naive Bayesian Model performs best, and it only takes 0.1677 seconds to process a sample. Considering that the ratio of training data set to test data set in this experiment is 4 : 1, from the approximate results, the ratio of training time to test time of classifier constructed based on Naive Bayesian algorithm is equal to the ratio of training data set to training data set, that is, the time complexity can be considered as On. Although the total time consumed by the TextCNN model is relatively large, the training and prediction time is relatively large, and the time complexity is similar to O(n). This means that when the data set is vast, the disadvantage of using the TextCNN algorithm to construct a classifier will be significantly reduced, which can even become a more efficient algorithm.Table 1
Efficiency performance of three classifier models.
trstpstsst¯sKNN2202.81339.632542.440.2472NBM1226.97308.741535.710.1677TextCNN2474.621213.953688.570.5090In summary, the accuracy of the three algorithms for application classification is above 85%. In terms of accuracy, the classification accuracy based on the TextCNN algorithm reached 91.65%, and the macro precision reached 93.68%, which is better than the other two classifier models. In terms of efficiency, the classifier model based on the Naive Bayes model takes only 0.1677 seconds to process a single sample, which is suitable for application stores with high-efficiency classification.


### 4.2.4. Determination of Parameters in the Malware Detection Model

In quantifying sensitive permission features based on weight allocation, the ratio measures the ability of permission features to distinguish malicious and benign samples. Figure4(a) shows the results of the accuracy rate A, precision rate Pre, recall rate Rec, and F1 value of the malware detection method as the parameters αβ change. It can be seen from the figure that when the parameter is small, especially when αβ = 1, the classifier’s evaluation metrics are not ideal, and the detection accuracy of malicious applications is only 59.76%. As the parameter αβ gradually increase, each evaluation metric curve rises with a larger slope, and the detection performance is significantly improved. When αβ = 4, each evaluation metric of the classifier reaches the maximum value. Therefore, the optimal value of the αβ should be 4.Figure 4
Experimental results of malware detection. (a)α/β optimization experiment results and (b) accuracy performance results of four methods.
(a)(b)


### 4.2.5. Performance Comparison of Four Different Malicious Detection Models

The Android malware detection method proposed in this paper is compared with the detection model without feature screening and using the binary method, the detection model with feature screening and using the binary method, and the detection model without feature screening and using the weight allocation method to compare the accuracy performance and efficiency performance of the four methods. Figure4(b) shows the results of these four methods on accuracy rate A, precision rate, recall rate, and F1 value. It can be seen from the figure that the accuracy rate of the malicious detection method proposed in this research reached 92.17%, and the precision rate reached 94.68%. It is obviously better than the other three methods in each index. Replacing the binary method with the weight allocation method, replacing the malicious application detection method by obtaining the sensitive permission feature set can increase the fine-grained of malware detection and improve malware detection accuracy.Table2 shows the efficiency performance of the above four methods in training time, prediction time, total time, and average sample time. In the case of feature screening, the weight allocation method and the binary method are almost the same in each time index. When the sensitive permission feature set is not extracted, the redundant features are too much, and the measured time is significantly increased. This shows that the method proposed in this paper successfully reduces the dimension of digital features and improves malicious detection efficiency. Compared with the traditional method of direct detection of unfiltered permission features, the proposed method reduces the time by 60.94%.Table 2
Efficiency performance of four detection models.
tr (s)tp (s)ts (s)t¯sThis research method423.2794.16517.430.1256Nonfeature screening, binary method903.75286.371190.120.3217Feature screening, binary method392.56106.12498.680.1282Nonfeature screening, weight allocation883.24230.691113.930.3012To sum up, the detection method for malicious Android applications proposed in this paper based on permission sensitivity has an accuracy rate of 92.17%, 60.94% less than the traditional detection method.


## 4.2.1.k-Nearest Neighbor Classifier

The accuracy of the classifier model constructed by thek-nearest neighbor algorithm mainly depends on two aspects: the value of k and the choice of distance calculation methods. In this experiment, these two parameters were tuned separately, and the results are shown in Figure 3.Figure 3
Experimental results of different classifiers. (a) KNN classifier with differentk values, (b) KNN classifier with different distance formulas, (c) NBM classifier under different models, and (d) performance of different classifier models.
(a)(b)(c)(d)Figure3(a) shows the evaluation metrics A, Pmacro, Rmacro, and F1macro of KNN classifier model using Euclidean distance under different k values. It can be seen that when k < 15, the performance of classifier accuracy is generally low and fluctuates significantly at that time. When k = 15, all the classifier’s evaluation indexes reached the best, which were 0.8842, 0.9016, 0.8749, and 0.8853, respectively. When k > 15, the indicators of the model declined slowly. Therefore, when k is 15, the k-nearest neighbor classifier model has the best performance.Figure3(b) shows the k-nearest neighbor classifier model’s performance results using Euclidean distance and Manhattan distance, respectively. From the graph, we can find that the A, Pmacro, Rmacro, and F1macro of the classifier using Manhattan distance formula are generally low, which is far less than the classifier’s performance using Euclidean distance under the same conditions. According to the above experimental results, when the k-nearest neighbor classifier model has the best performance, the value of k should be 15, and the distance calculation method should be Euclidean distance.


## 4.2.2. Naive Bayes Model Classifier

The classifier model’s parameters based on the Naive Bayes Model are optimized to explore the distribution model (Bernoulli Model, Multivariate Distribution Model), which makes the accuracy performance of the classifier model the best. The results are shown in Figure3(c). It can be seen from Figure 3(c) that under the same data set, the evaluation metrics obtained using the multivariate distribution model are better than those using the Bernoulli model, which is of great help to improve the accuracy performance of the classifier.


## 4.2.3. Performance Comparison of Three Classifier Models

TextCNN algorithm is a representative algorithm model to solve the problems of text classification and semantic analysis. Compared to thek-nearest neighbor algorithm classifier model, the Naive Bayes algorithm classifier model, and the TextCNN algorithm classifier model with the performance, the results are shown in Figure 3(d). The graph shows that the A, Pmacro, Rmacro, and F1macro of the classifier constructed based on the TextCNN algorithm are 0.9165, 0.9368, 0.8971, and 0.9127, respectively, which are better than the other two models. It can be seen that in the data sets and application scenarios of this study, the deep learning algorithm is more suitable than the traditional machine-learning algorithm in constructing a classifier model to complete the automatic application category determination based on semantic analysis.Table1 shows the performance of the three models on classification speed. It can be seen from Table 1 that in the total training and prediction time, the TextCNN classifier model with the best accuracy performance takes the most time, reaching 3688.57 seconds. In terms of the average training and prediction time of a single sample, the Naive Bayesian Model performs best, and it only takes 0.1677 seconds to process a sample. Considering that the ratio of training data set to test data set in this experiment is 4 : 1, from the approximate results, the ratio of training time to test time of classifier constructed based on Naive Bayesian algorithm is equal to the ratio of training data set to training data set, that is, the time complexity can be considered as On. Although the total time consumed by the TextCNN model is relatively large, the training and prediction time is relatively large, and the time complexity is similar to O(n). This means that when the data set is vast, the disadvantage of using the TextCNN algorithm to construct a classifier will be significantly reduced, which can even become a more efficient algorithm.Table 1
Efficiency performance of three classifier models.
trstpstsst¯sKNN2202.81339.632542.440.2472NBM1226.97308.741535.710.1677TextCNN2474.621213.953688.570.5090In summary, the accuracy of the three algorithms for application classification is above 85%. In terms of accuracy, the classification accuracy based on the TextCNN algorithm reached 91.65%, and the macro precision reached 93.68%, which is better than the other two classifier models. In terms of efficiency, the classifier model based on the Naive Bayes model takes only 0.1677 seconds to process a single sample, which is suitable for application stores with high-efficiency classification.


## 4.2.4. Determination of Parameters in the Malware Detection Model

In quantifying sensitive permission features based on weight allocation, the ratio measures the ability of permission features to distinguish malicious and benign samples. Figure4(a) shows the results of the accuracy rate A, precision rate Pre, recall rate Rec, and F1 value of the malware detection method as the parameters αβ change. It can be seen from the figure that when the parameter is small, especially when αβ = 1, the classifier’s evaluation metrics are not ideal, and the detection accuracy of malicious applications is only 59.76%. As the parameter αβ gradually increase, each evaluation metric curve rises with a larger slope, and the detection performance is significantly improved. When αβ = 4, each evaluation metric of the classifier reaches the maximum value. Therefore, the optimal value of the αβ should be 4.Figure 4
Experimental results of malware detection. (a)α/β optimization experiment results and (b) accuracy performance results of four methods.
(a)(b)


## 4.2.5. Performance Comparison of Four Different Malicious Detection Models

The Android malware detection method proposed in this paper is compared with the detection model without feature screening and using the binary method, the detection model with feature screening and using the binary method, and the detection model without feature screening and using the weight allocation method to compare the accuracy performance and efficiency performance of the four methods. Figure4(b) shows the results of these four methods on accuracy rate A, precision rate, recall rate, and F1 value. It can be seen from the figure that the accuracy rate of the malicious detection method proposed in this research reached 92.17%, and the precision rate reached 94.68%. It is obviously better than the other three methods in each index. Replacing the binary method with the weight allocation method, replacing the malicious application detection method by obtaining the sensitive permission feature set can increase the fine-grained of malware detection and improve malware detection accuracy.Table2 shows the efficiency performance of the above four methods in training time, prediction time, total time, and average sample time. In the case of feature screening, the weight allocation method and the binary method are almost the same in each time index. When the sensitive permission feature set is not extracted, the redundant features are too much, and the measured time is significantly increased. This shows that the method proposed in this paper successfully reduces the dimension of digital features and improves malicious detection efficiency. Compared with the traditional method of direct detection of unfiltered permission features, the proposed method reduces the time by 60.94%.Table 2
Efficiency performance of four detection models.
tr (s)tp (s)ts (s)t¯sThis research method423.2794.16517.430.1256Nonfeature screening, binary method903.75286.371190.120.3217Feature screening, binary method392.56106.12498.680.1282Nonfeature screening, weight allocation883.24230.691113.930.3012To sum up, the detection method for malicious Android applications proposed in this paper based on permission sensitivity has an accuracy rate of 92.17%, 60.94% less than the traditional detection method.


## 5. Conclusion

In this paper, an Android malware detection method based on permission sensitivity is proposed. Based on the application category label and permission request information, the concepts of permission vector, permission matrix, and permission sensitivity are established, and the sensitive permission feature set corresponding to each category label is obtained by mathematical formula reasoning. Through the weight allocation method, each permission feature is given a weight value that measures the strength of distinguishing malicious and benign samples to form a digital feature. The classifier constructed by the random forest algorithm is used for malicious detection, and multiple sets of experiments are set for verification and comparison.The experimental results show that the accuracy rate of the Android malware detection method can reach 92.17%, and the precision rate can reach 94.68%. Compared with the traditional detection method based on permission features, the time consumption of the malware detection method is reduced by 60.94%.



---

*Source: 6689486-2021-07-29.xml*