| The D* set consists of metrics with respect to which the mean of benign benchmark apps and that of malicious benchmark apps differ by at least 2% (i.e., noticeably different) | |||||||
| The D set consists of metrics with respect to which the mean of benign benchmark apps and that of malicious benchmark apps differ by at least 5% (i.e., disparately different) | |||||||
| Dimension | Id | Name | Description | in D* Set | in D Set | ||
| General | 1 | SDK->SDK | Percentage of calls from SDK to SDK | ✔ | ✔ | ||
| 2 | SDK->3rdLib | Percentage of calls from SDK to third-party library | |||||
| 3 | SDK->UserCode | Percentage of calls from SDK to user code | |||||
| 4 | 3rdLib->SDK | Percentage of calls from third-party library to SDK | ✔ | ✔ | |||
| 5 | 3rdLib->3rdLib | Percentage of calls from third-party library to third-party library | |||||
| 6 | 3rdLib->UserCode | Percentage of calls from third-party library to user code | |||||
| 7 | UserCode->SDK | Percentage of calls from user code to SDK | ✔ | ✔ | |||
| 8 | UserCode->3rdLib | Percentage of calls from user code to third-party library | |||||
| 9 | UserCode->UserCode | Percentage of calls from user code to user code | |||||
| 10 | userCode-cls | Percentage out of all executed classes that are defined in user code, counting unique class signatures only | ✔ | ✔ | |||
| 11 | 3rdLib-cls | Percentage out of all executed classes that are defined in third-party libraries, counting unique class signatures only | ✔ | ||||
| 12 | sdk-cls | Percentage out of all executed classes that are defined in SDK, counting unique class signatures only | ✔ | ||||
| 13 | userCode-me | Percentage out of all executed methods that are defined in user code, counting unique method signatures only | ✔ | ✔ | |||
| 14 | 3rdlib-me | Percentage out of all executed methods that are defined in third-party libraries, counting unique method signatures only | ✔ | ||||
| 15 | sdk-me | Percentage out of all executed methods that are defined in SDK, counting unique method signatures only | ✔ | ||||
| 16 | userCode-clsIns | Percentage out of all executed classes that are defined in user code, counting all class signature instances | ✔ | ✔ | |||
| 17 | 3rdLib-clsIns | Percentage out of all executed classes that are defined in third-party libraries, counting all class signature instances | |||||
| 18 | sdk-clsIns | Percentage out of all executed classes that are defined in SDK, counting all class signature instances | |||||
| 19 | userCode-meIns | Percentage out of all executed methods that are defined in user code, counting all method signature instances | ✔ | ✔ | |||
| 20 | 3rdlib-meIns | Percentage out of all executed methods that are defined in third-party libraries, counting all method signature instances | |||||
| 21 | sdk-meIns | Percentage out of all executed methods that are defined in SDK, counting all method signature instances | |||||
| 22 | activity | Percentage out of all executed components that are Activity components, counting unique class signatures | ✔ | ||||
| 23 | service | Percentage out of all executed components that are Service components, counting unique class signatures | ✔ | ||||
| 24 | receiver | Percentage out of all executed components that are BroadcastReceiver components, counting unique class signatures | ✔ | ||||
| 25 | provider | Percentage out of all executed components that are ContentProvider components, counting unique class signatures | |||||
| 26 | activityIns | Percentage out of all executed components that are Activity components, counting all class signature instances | |||||
| 27 | serviceIns | Percentage out of all executed components that are Service components, counting all class signature instances | |||||
| 28 | receiverIns | Percentage out of all executed components that are BroadcastReceiver components, counting all class signature instances | ✔ | ||||
| 29 | providerIns | Percentage out of all executed components that are ContentProvider components, counting all class signature instances | |||||
| 30 | lc | Percentage out of all executed methods that are lifecycle (callback) methods, counting unique method signatures | |||||
| 31 | eh | Percentage out of all executed methods that are event handlers (callback) methods, counting unique method signatures | |||||
| 32 | lc-ins | Percentage out of all executed methods that are lifecycle (callback) methods, counting all method signature instances | |||||
| 33 | eh-ins | Percentage out of all executed methods that are event handlers (callback) methods, counting all method signature instances | |||||
| 34 | Activity | Percentage out of all executed lifecycle methods that are callbacks defined in Activity components, counting unique method signatures | ✔ | ✔ | |||
| 35 | Activity-Ins | Percentage out of all executed lifecycle methods that are callbacks defined in Activity components, counting all method signature instances | ✔ | ✔ | |||
| 36 | Application | Percentage out of all executed lifecycle methods that are callbacks defined in Application classes/subclasses, counting unique method signatures | ✔ | ✔ | |||
| 37 | Application-Ins | Percentage out of all executed lifecycle methods that are callbacks defined in Application classes/subclasses, counting all method signature instances | ✔ | ✔ | |||
| 38 | BroadcastReceiver | Percentage out of all executed lifecycle methods that are callbacks defined in BroadcastReceiver components, counting unique method signatures | |||||
| 39 | BroadcastReceiver-Ins | Percentage out of all executed lifecycle methods that are callbacks defined in BroadcastReceiver components, counting all method signature instances | |||||
| 40 | ContentProvider | Percentage out of all executed lifecycle methods that are callbacks defined in ContentProvider components, counting unique method signatures | ✔ | ||||
| 41 | ContentProvider-Ins | Percentage out of all executed lifecycle methods that are callbacks defined in ContentProvider components, counting all method signature instances | ✔ | ||||
| 42 | Service | Percentage out of all executed lifecycle methods that are callbacks defined in Service components, counting unique method signatures | ✔ | ||||
| 43 | Service-Ins | Percentage out of all executed lifecycle methods that are callbacks defined in Service components, counting all method signature instances | ✔ | ||||
| 44 | APPLICATION_MANAGEMENT | Percentage out of all executed event handlers that are callbacks handling system events for application management, counting unique method signatures | ✔ | ||||
| 45 | APPLICATION_MANAGEMENT-Ins | Percentage out of all executed event handlers that are callbacks handling system events for application management, counting all method signature instances | ✔ | ||||
| 46 | SYSTEM_STATUS | Percentage out of all executed event handlers that are callbacks handling system events related to system status access and management, counting unique method signatures | ✔ | ✔ | |||
| 47 | SYSTEM_STATUS-Ins | Percentage out of all executed event handlers that are callbacks handling system events related to system status access and management, counting all method signature instances | ✔ | ✔ | |||
| 48 | LOCATION_STATUS | Percentage out of all executed event handlers that are callbacks handling system events related to location info access and management, counting unique method signatures | ✔ | ||||
| 49 | LOCATION_STATUS-Ins | Percentage out of all executed event handlers that are callbacks handling system events related to location info access and management, counting all method signature instances | ✔ | ||||
| 50 | HARDWARE_MANAGEMENT | Percentage out of all executed event handlers that are callbacks handling system events relevant to hardware management, counting unique method signatures | |||||
| 51 | HARDWARE_MANAGEMENT-Ins | Percentage out of all executed event handlers that are callbacks handling system events relevant to hardware management, counting all method signature instances | |||||
| 52 | NETWORK_MANAGEMENT | Percentage out of all executed event handlers that are callbacks handling system events relevant to network management, counting unique method signatures | |||||
| 53 | NETWORK_MANAGEMENT-Ins | Percentage out of all executed event handlers that are callbacks handling system events relevant to network management, counting all method signature instances | |||||
| 54 | APP_BAR | Percentage out of all executed event handlers that are callbacks handling UI events relevant to application bars, counting unique method signatures | |||||
| 55 | APP_BAR-Ins | Percentage out of all executed event handlers that are callbacks handling events UI relevant to application bars, counting all method signature instances | |||||
| 56 | MEDIA_CONTROL | Percentage out of all executed event handlers that are callbacks handling UI events relevant to media controls, counting unique method signatures | |||||
| 57 | MEDIA_CONTROL-Ins | Percentage out of all executed event handlers that are callbacks handling UI events relevant to media controls, counting all method signature instances | |||||
| 58 | VIEW | Percentage out of all executed event handlers that are callbacks handling UI events relevant to Views, counting unique method signatures | ✔ | ✔ | |||
| 59 | VIEW-Ins | Percentage out of all executed event handlers that are callbacks handling UI events relevant to Views, counting all method signature instances | ✔ | ✔ | |||
| 60 | WIDGET | Percentage out of all executed event handlers that are callbacks handling UI events relevant to widgets, counting unique method signatures | |||||
| 61 | WIDGET-Ins | Percentage out of all executed event handlers that are callbacks handling UI events relevant to widgets, counting all method signature instances | |||||
| 62 | DIALOG | Percentage out of all executed event handlers that are callbacks handling UI events relevant to dialogs, counting unique method signatures | |||||
| 63 | DIALOG-Ins | Percentage out of all executed event handlers that are callbacks handling UI events relevant to dialogs, counting all method signature instances | |||||
| ICC | 64 | int_ex | Percentage out of all exercised ICCs that are internal explicit ICCs (those that are between components within the same app and have target specified explicitly) | ✔ | |||
| 65 | int_im | Percentage out of all exercised ICCs that are internal implicit ICCs (those that are between components within the same app and do NOT have target specified explicitly) | |||||
| 66 | ext_ex | Percentage out of all exercised ICCs that are external explicit ICCs (those that are between components across two different apps and have target specified explicitly) | ✔ | ||||
| 67 | ext_im | Percentage of all exercised ICCs that are internal implicit ICCs (those that are between components across two different apps and do NOT have target specified explicitly) | |||||
| 68 | data_only | Percentage out of all exercised ICCs that carry URI data only in the associated Intents (i.e., the 'data' field of Intent objects are non-void) | ✔ | ||||
| 69 | extras_only | Percentage out of all exercised ICCs that carry extras data only in the associated Intents (i.e., the 'extras' field of Intent objects are non-void) | ✔ | ||||
| 70 | data_both | Percentage out of all exercised ICCs that carry both URI and extras data only in the associated Intents (i.e., the 'data' and 'extras' fields of Intent objects are non-void) | ✔ | ||||
| Security | 71 | src | Percentage out of all call targets that are source APIs, counting unique method signatures | ✔ | ✔ | ||
| 72 | sink | Percentage out of all call targets that are sink APIs, counting unique method signatures | ✔ | ||||
| 73 | srcIns | Percentage out of all call targets that are source APIs, counting all method signature instances | ✔ | ✔ | |||
| 74 | sinkIns | Percentage out of all call targets that are sink APIs, counting all method signature instances | ✔ | ||||
| 75 | riskSrc | Percentage out of all exercised source APIs that reach (via method-level control flows) at least one sink API call, counting unique method signatures | ✔ | ✔ | |||
| 76 | riskSink | Percentage out of all exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, counting unique method signatures | ✔ | ||||
| 77 | riskSrcIns | Percentage out of all exercised source APIs that reach (via method-level control flows) at least one sink API call, counting all method signature instances | ✔ | ||||
| 78 | riskSinkIns | Percentage out of all exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, counting all method signature instances | ✔ | ||||
| 79 | ACCOUNT_INFORMATION | Percentage out of all exercised source APIs that access account information, counting unique method signatures | |||||
| 80 | ACCOUNT_INFORMATION-Ins | Percentage out of all exercised source APIs that access account information, counting all method signature instances | |||||
| 81 | ACCOUNT_INFORMATION-escape | Out of the exercised source APIs that reach (via method-level control flows) at least one sink API call, percentage that access account information, counting unique method signatures | |||||
| 82 | ACCOUNT_INFORMATION-escape-Ins | Out of the exercised source APIs that reach (via method-level control flows) at least one sink API call, percentage that access account information, counting all method signature instances | |||||
| 83 | CALENDAR_INFORMATION | Percentage out of all exercised source APIs that access calendar information, counting unique method signatures | |||||
| 84 | CALENDAR_INFORMATION-Ins | Percentage out of all exercised source APIs that access calendar information, counting all method signature instances | |||||
| 85 | CALENDAR_INFORMATION-escape | Out of the exercised source APIs that reach (via method-level control flows) at least one sink API call, percentage that access calendar information, counting unique method signatures | |||||
| 86 | CALENDAR_INFORMATION-escape-Ins | Out of the exercised source APIs that reach (via method-level control flows) at least one sink API call, percentage that access calendar information, counting all method signature instances | |||||
| 87 | LOCATION_INFORMATION | Percentage out of all exercised source APIs that access location information, counting unique method signatures | ✔ | ✔ | |||
| 88 | LOCATION_INFORMATION-Ins | Percentage out of all exercised source APIs that access location information, counting all method signature instances | ✔ | ||||
| 89 | LOCATION_INFORMATION-escape | Out of the exercised source APIs that reach (via method-level control flows) at least one sink API call, percentage that access location information, counting unique method signatures | ✔ | ✔ | |||
| 90 | LOCATION_INFORMATION-escape-Ins | Out of the exercised source APIs that reach (via method-level control flows) at least one sink API call, percentage that access location information, counting all method signature instances | ✔ | ||||
| 91 | NETWORK_INFORMATION | Percentage out of all exercised source APIs that access network information, counting unique method signatures | ✔ | ✔ | |||
| 92 | NETWORK_INFORMATION-Ins | Percentage out of all exercised source APIs that access network information, counting all method signature instances | ✔ | ✔ | |||
| 93 | NETWORK_INFORMATION-escape | Out of the exercised source APIs that reach (via method-level control flows) at least one sink API call, percentage that access network information, counting unique method signatures | ✔ | ✔ | |||
| 94 | NETWORK_INFORMATION-escape-Ins | Out of the exercised source APIs that reach (via method-level control flows) at least one sink API call, percentage that access network information, counting all method signature instances | ✔ | ✔ | |||
| 95 | SYSTEM_SETTINGS | Percentage out of all exercised source APIs that access system settings, counting unique method signatures | ✔ | ✔ | |||
| 96 | SYSTEM_SETTINGS-Ins | Percentage out of all exercised source APIs that access system settings, counting all method signature instances | ✔ | ||||
| 97 | SYSTEM_SETTINGS-escape | Out of the exercised source APIs that reach (via method-level control flows) at least one sink API call, percentage that access system settings, counting unique method signatures | ✔ | ✔ | |||
| 98 | SYSTEM_SETTINGS-escape-Ins | Out of the exercised source APIs that reach (via method-level control flows) at least one sink API call, percentage that access system settings, counting all method signature instances | ✔ | ||||
| 99 | ACCOUNT_SETTINGS | Percentage out of all exercised sink APIs that aims at operations on account settings, counting unique method signatures | ✔ | ||||
| 100 | ACCOUNT_SETTINGS-Ins | Percentage out of all exercised sink APIs that aims at operations on account settings, counting all method signature instances | |||||
| 101 | ACCOUNT_SETTINGS-reach | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at operations on account settings, counting unique method signatures | ✔ | ||||
| 102 | ACCOUNT_SETTINGS-reach-Ins | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at operations on account settings, counting all method signature instances | |||||
| 103 | FILE | Percentage out of all exercised sink APIs that aims at file operations, counting unique method signatures | |||||
| 104 | FILE-Ins | Percentage out of all exercised sink APIs that aims at file operations, counting all method signature instances | |||||
| 105 | FILE-reach | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at file operations, counting unique method signatures | |||||
| 106 | FILE-reach-Ins | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at file operations, counting all method signature instances | |||||
| 107 | LOG | Percentage out of all exercised sink APIs that aims at logging operations, counting unique method signatures | ✔ | ✔ | |||
| 108 | LOG-Ins | Percentage out of all exercised sink APIs that aims at logging operations, counting all method signature instances | ✔ | ✔ | |||
| 109 | LOG-reach | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at logging operations, counting unique method signatures | ✔ | ✔ | |||
| 110 | LOG-reach-Ins | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at logging operations, counting all method signature instances | ✔ | ✔ | |||
| 111 | NETWORK | Percentage out of all exercised sink APIs that aims at networking operations, counting unique method signatures | |||||
| 112 | NETWORK-Ins | Percentage out of all exercised sink APIs that aims at networking operations, counting all method signature instances | ✔ | ✔ | |||
| 113 | NETWORK-reach | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at networking operations, counting unique method signatures | |||||
| 114 | NETWORK-reach-Ins | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at networking operations, counting all method signature instances | ✔ | ✔ | |||
| 115 | SMS_MMS | Percentage out of all exercised sink APIs that aims at messaging operations, counting unique method signatures | ✔ | ✔ | |||
| 116 | SMS_MMS-Ins | Percentage out of all exercised sink APIs that aims at messaging operations, counting all method signature instances | ✔ | ✔ | |||
| 117 | SMS_MMS-reach | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at messaging operations, counting unique method signatures | ✔ | ✔ | |||
| 118 | SMS_MMS-reach-Ins | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at messaging operations, counting all method signature instances | ✔ | ✔ | |||
| 119 | SYSTEM_SETTINGS | Percentage out of all exercised sink APIs that aims at operations on system settings, counting unique method signatures | |||||
| 120 | SYSTEM_SETTINGS-Ins | Percentage out of all exercised sink APIs that aims at operations on system settings, counting all method signature instances | ✔ | ||||
| 121 | SYSTEM_SETTINGS-reach | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at operations on system settings, counting unique method signatures | |||||
| 122 | SYSTEM_SETTINGS-reach-Ins | Out of the exercised sink APIs that are reachable (via method-level control flows) from at least one source API call, percentage that aims at operations on system settings, counting all method signature instances | ✔ | ||||