The Effective Ransomware Prevention Technique Using Process Monitoring on Android Platform

Table 2

Difference in permission between Ransomware App and Normal App [21, 22].

Type	Permission	Behavior	Ransomware App	Normal; App
System	GET_TASK	Allows an application to get information about currently or recently running tasks	O	O
	WRITE_SETTINGS	Allows an application to read or write system settings	O	O
	SYSTEM_ALERT_WINDOW	Allows an application to alert system	O	O
	RECEIVE_BOOT_COMPLETED	Allows an application to receive the ACTION_BOOT_COMPLETED that is broadcasted after the system finishes booting	O	X
	READ_PHONE_STATE	Allows read only access to phone state	O	X
	READ_EXTERNAL_STORAGE	Allows an application to read from external storage	O	X
	WRITE_EXTERNAL_STORAGE	Allows an application to write to external storage	O	X
	WAKE_LOCK	Allows using PowerManager WakeLocks to keep Processor from sleeping or screen from dimming	O	X
	GET_ACCOUNTS	Allows access to the list of accounts in Accounts Service	O	X
	BIND_DEVICE_ADMIN	Must be required by device administration receiver to ensure that only the system can interact with it	O	X
	DISABLE_KEYGUARD	Allows applications to disable the keyguard if it is not secure	O	X
SMS	RECEIVE_SMS	Allows an application to receive SMS messages	O	O
	SEND_SMS	Allows an application to send SMS messages	O	O
	READ_SMS	Allows an application to read SMS messages	O	X
Contact	READ_CONTACTS	Allows an application to read user’s contacts data	O	O
	READ_CALL_LOG	Allows an application to read the user’s call log	O	O
	CALL_PHONE	Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call	O	O
Network	INTERNET	Allows applications to open network sockets	O	X
	ACCESS_NETWORK_STATE	Allows applications to access information about networks	O	X
	READ_HISTORY_BOOKMARKS	Allows an application to read the user’s browsing history and bookmarks	O	X