Research Article
KTSDroid: A Framework for Android Malware Categorization Using the Kernel Task Structure
Table 8
Selected features using mutual information (MI).
| Rep | Feature name | MI score |
| M_F1 | task -> mm -> mmap -> vm_file -> f_inode -> i_generation | 1.51 | M_F2 | task -> mm -> mmap_base | 1.50 | M_F3 | task -> mm -> brk | 1.50 | M_F4 | task -> mm -> mmap_legacy_base | 1.49 | M_F5 | task -> mm -> start_brk | 1.49 | M_F6 | task -> mm -> end_data | 1.49 | M_F7 | task -> mm -> start_code | 1.49 | M_F8 | task -> mm -> start_data | 1.49 | M_F9 | task -> mm -> end_code | 1.48 | M_F10 | task -> mm -> mmap -> vm_file -> f_inode -> i_ino | 1.43 | M_F11 | task -> mm -> shared_vm | 0.74 | M_F12 | task -> mm -> total_vm | 0.64 | M_F13 | task -> mm -> hiwater_vm | 0.59 | M_F14 | task -> mm -> exec_vm | 0.47 | M_F15 | task -> mm -> env_end | 0.43 | M_F16 | task -> mm -> start_stack | 0.43 | M_F17 | task -> mm -> arg_end | 0.42 | M_F18 | task -> mm -> arg_start | 0.42 | M_F19 | task -> mm -> env_start | 0.42 | M_F20 | task -> mm -> highest_vm_end | 0.41 | M_F21 | task -> mm -> mm_count -> counter | 0.41 | P_F1 | task -> cred -> session_keyring -> last_used_at | 1.51 | P_F2 | task -> real_cred -> session_keyring -> last_used_at | 1.51 | P_F3 | task -> real_cred -> session_keyring -> serial | 1.50 | P_F4 | task -> cred -> session_keyring -> serial | 1.50 | S_F1 | task -> sas_ss_sp | 1.49 | S_F2 | task -> signal -> ioac -> rchar | 0.60 | S_F3 | task -> signal -> ioac -> wchar | 0.46 | S_F4 | task -> signal -> real_timer -> base -> cpu_base -> clock_was_set_seq | 0.38 |
|
|