{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T02:54:49Z","timestamp":1783479289345,"version":"3.55.0"},"reference-count":48,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2022,2,4]],"date-time":"2022-02-04T00:00:00Z","timestamp":1643932800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,2,4]],"date-time":"2022-02-04T00:00:00Z","timestamp":1643932800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cluster Comput"],"published-print":{"date-parts":[[2022,8]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>In the last decades, mobile-based apps have been increasingly used in several application fields for many purposes involving a high number of human activities. Unfortunately, in addition to this, the number of cyber-attacks related to mobile platforms is increasing day-by-day. However, although advances in Artificial Intelligence science have allowed addressing many aspects of the problem, malware classification tasks are still challenging. For this reason, the following paper aims to propose new special features, called permission maps (Perm-Maps), which combine information related to the Android permissions and their corresponding severity levels. Such features have proven to be very effective in classifying different malware families through the usage of a convolutional neural network. Also, the advantages introduced by the Perm-Maps have been enhanced by a training process based on a federated logic. Experimental results show that the proposed approach achieves up to a 3% improvement in average accuracy with respect to J48 trees and Naive Bayes classifier, and up to 16% compared to multi-layer perceptron classifier. Furthermore, the combined use of Perm-Maps and federated logic allows dealing with unbalanced training datasets with low computational efforts.<\/jats:p>","DOI":"10.1007\/s10586-021-03490-2","type":"journal-article","created":{"date-parts":[[2022,2,4]],"date-time":"2022-02-04T11:28:30Z","timestamp":1643974110000},"page":"2487-2500","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":22,"title":["A federated approach to Android malware classification through Perm-Maps"],"prefix":"10.1007","volume":"25","author":[{"given":"Gianni","family":"D\u2019Angelo","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Francesco","family":"Palmieri","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3423-3374","authenticated-orcid":false,"given":"Antonio","family":"Robustelli","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,2,4]]},"reference":[{"key":"3490_CR1","unstructured":"Android: define a custom app permission. https:\/\/developer.android.com\/guide\/topics\/permissions\/defining. Accessed 2021"},{"key":"3490_CR2","unstructured":"Android: Manifest.permission. https:\/\/developer.android.com\/reference\/android\/Manifest.permission. Accessed 2021"},{"key":"3490_CR3","unstructured":"Android: $\\langle {{\\rm permission}}\\rangle $. https:\/\/developer.android.com\/guide\/topics\/manifest\/permission-element. Accessed 2021"},{"key":"3490_CR4","unstructured":"Android: permissions on Android. https:\/\/developer.android.com\/guide\/topics\/permissions\/overview. Accessed 2021"},{"key":"3490_CR5","unstructured":"Android: R.attr | protectionlevel. https:\/\/developer.android.com\/reference\/android\/R.attr. Accessed 2021"},{"key":"3490_CR6","doi-asserted-by":"publisher","first-page":"100403","DOI":"10.1016\/j.softx.2020.100403","volume":"11","author":"S Aonzo","year":"2020","unstructured":"Aonzo, S., Georgiu, G.C., Verderame, L., Merlo, A.: Obfuscapk: an open-source black-box obfuscation tool for Android apps. SoftwareX 11, 100403 (2020). https:\/\/doi.org\/10.1016\/j.softx.2020.100403","journal-title":"SoftwareX"},{"issue":"2","key":"3490_CR7","doi-asserted-by":"publisher","first-page":"213","DOI":"10.1109\/TSUSC.2017.2774184","volume":"5","author":"S Aonzo","year":"2020","unstructured":"Aonzo, S., Merlo, A., Migliardi, M., Oneto, L., Palmieri, F.: Low-resource footprint, data-driven malware detection on Android. IEEE Trans. Sustain. Comput. 5(2), 213\u2013222 (2020)","journal-title":"IEEE Trans. Sustain. Comput."},{"key":"3490_CR8","doi-asserted-by":"publisher","unstructured":"Arp, D., Spreitzenbarth, M., H\u00fcbner, M., Gascon, H., Rieck, K.: Drebin: effective and explainable detection of Android malware in your pocket (2014). https:\/\/doi.org\/10.14722\/ndss.2014.23247","DOI":"10.14722\/ndss.2014.23247"},{"key":"3490_CR9","volume-title":"Applied Deep Learning with Keras: Solve Complex Real-Life Problems with the Simplicity of Keras","author":"R Bhagwat","year":"2019","unstructured":"Bhagwat, R., Abdolahnejad, M., Moocarme, M.: Applied Deep Learning with Keras: Solve Complex Real-Life Problems with the Simplicity of Keras. Packt Publishing, Birmingham (2019)"},{"key":"3490_CR10","doi-asserted-by":"publisher","unstructured":"Carrez, F., Elsaleh, T., G\u00f3mez, D., S\u00e1nchez, L., Lanza, J., Grace, P.: A reference architecture for federating IoT infrastructures supporting semantic interoperability. In: 2017 European Conference on Networks and Communications (EuCNC), pp. 1\u20136 (2017). https:\/\/doi.org\/10.1109\/EuCNC.2017.7980765","DOI":"10.1109\/EuCNC.2017.7980765"},{"key":"3490_CR11","unstructured":"CuckooDroid: CuckooDroid Book. https:\/\/cuckoo-droid.readthedocs.io\/en\/latest\/. Accessed 2020"},{"key":"3490_CR12","doi-asserted-by":"publisher","DOI":"10.1080\/09540091.2021.1889977","author":"G D\u2019Angelo","year":"2021","unstructured":"D\u2019Angelo, G., Palmieri, F., Robustelli, A., Castiglione, A.: Effective classification of Android malware families through dynamic features and neural networks. Connect. Sci. (2021). https:\/\/doi.org\/10.1080\/09540091.2021.1889977","journal-title":"Connect. Sci."},{"key":"3490_CR13","doi-asserted-by":"publisher","first-page":"26","DOI":"10.1016\/j.jpdc.2019.11.001","volume":"137","author":"G D\u2019Angelo","year":"2020","unstructured":"D\u2019Angelo, G., Ficco, M., Palmieri, F.: Malware detection in mobile environments based on autoencoders and API-images. J. Parallel Distrib. Comput. 137, 26\u201333 (2020). https:\/\/doi.org\/10.1016\/j.jpdc.2019.11.001","journal-title":"J. Parallel Distrib. Comput."},{"key":"3490_CR14","doi-asserted-by":"crossref","unstructured":"David, O., Netanyahu, N.S.: DeepSign: deep learning for automatic malware signature generation and classification. In: International Joint Conference on Neural Networks (IJCNN) pp. 1\u20138 (2015)","DOI":"10.1109\/IJCNN.2015.7280815"},{"key":"3490_CR15","unstructured":"Desnos, A., Gueguen, G.: Androguard. https:\/\/github.com\/androguard\/androguard. Accessed 2020"},{"key":"3490_CR16","doi-asserted-by":"publisher","unstructured":"Ficco, M.: Detecting IoT malware by Markov chain behavioral models. pp. 229\u2013234 (2019). https:\/\/doi.org\/10.1109\/IC2E.2019.00037","DOI":"10.1109\/IC2E.2019.00037"},{"key":"3490_CR17","unstructured":"G DATA: G DATA Mobile Malware Report 2019: New High for Malicious Android Apps. https:\/\/www.gdatasoftware.com\/news\/g-data-mobile-malware-report-2019-new-high-for-malicious-android-apps. Accessed 2020"},{"key":"3490_CR18","unstructured":"Guardsquare: DexGuard. Guardsquare. https:\/\/www.guardsquare.com\/dexguard. Accessed 2021"},{"key":"3490_CR19","unstructured":"Guardsquare: ProGuard. Guardsquare. https:\/\/www.guardsquare.com\/proguard. Accessed 2021"},{"key":"3490_CR20","unstructured":"Idanr: CuckooDroid\u2014automated Android malware analysis. https:\/\/github.com\/idanr1986\/cuckoo-droid. Accessed 2020"},{"key":"3490_CR21","doi-asserted-by":"publisher","first-page":"S48","DOI":"10.1016\/j.diin.2018.01.007","volume":"24","author":"EB Karbab","year":"2018","unstructured":"Karbab, E.B., Debbabi, M., Derhab, A., Mouheb, D.: MalDozer: automatic framework for Android malware detection using deep learning. Digit. Investig. 24, S48\u2013S59 (2018). https:\/\/doi.org\/10.1016\/j.diin.2018.01.007","journal-title":"Digit. Investig."},{"key":"3490_CR22","unstructured":"Kaspersky: Android mobile security threats. https:\/\/www.kaspersky.com\/resource-center\/threats\/mobile. Accessed 2020"},{"key":"3490_CR23","doi-asserted-by":"publisher","unstructured":"Kelaidonis, D., Rouskas, A., Stavroulaki, V., Demestichas, P., Vlacheas, P.: A federated edge cloud-IoT architecture. In: 2016 European Conference on Networks and Communications (EuCNC), pp. 230\u2013234 (2016). https:\/\/doi.org\/10.1109\/EuCNC.2016.7561038","DOI":"10.1109\/EuCNC.2016.7561038"},{"key":"3490_CR24","doi-asserted-by":"publisher","first-page":"137","DOI":"10.1007\/978-3-319-50127-7_11","volume-title":"AI 2016: Advances in Artificial Intelligence","author":"B Kolosnjaji","year":"2016","unstructured":"Kolosnjaji, B., Zarras, A., Webster, G., Eckert, C.: Deep learning for classification of malware system call sequences. In: Kang, B.H., Bai, Q. (eds.) AI 2016: Advances in Artificial Intelligence, pp. 137\u2013149. Springer, Cham (2016)"},{"key":"3490_CR25","doi-asserted-by":"publisher","unstructured":"Kumar, A., Sagar, K.P., Kuppusamy, K.S., Aghila, G.: Machine learning based malware classification for Android applications using multimodal image representations. In: 2016 10th International Conference on Intelligent Systems and Control (ISCO), pp. 1\u20136 (2016). https:\/\/doi.org\/10.1109\/ISCO.2016.7726949","DOI":"10.1109\/ISCO.2016.7726949"},{"key":"3490_CR26","doi-asserted-by":"publisher","first-page":"184008","DOI":"10.1109\/ACCESS.2019.2958927","volume":"7","author":"C Li","year":"2019","unstructured":"Li, C., Mills, K., Niu, D., Zhu, R., Zhang, H., Kinawi, H.: Android malware detection based on factorization machine. IEEE Access 7, 184008\u2013184019 (2019). https:\/\/doi.org\/10.1109\/ACCESS.2019.2958927","journal-title":"IEEE Access"},{"key":"3490_CR27","doi-asserted-by":"publisher","unstructured":"Li, D., Wang, Z., Xue, Y.: Fine-grained Android malware detection based on deep learning. In: 2018 IEEE Conference on Communications and Network Security (CNS), pp. 1\u20132 (2018). https:\/\/doi.org\/10.1109\/CNS.2018.8433204","DOI":"10.1109\/CNS.2018.8433204"},{"key":"3490_CR28","doi-asserted-by":"crossref","unstructured":"Li, Y., Jang, J., Hu, X., Ou, X.: Android malware clustering through malicious payload mining. In: Lecture Notes in Computer Science, pp. 192\u2013214 (2017). http:\/\/arxiv.org\/abs\/1707.04795","DOI":"10.1007\/978-3-319-66332-6_9"},{"issue":"2","key":"3490_CR29","doi-asserted-by":"publisher","first-page":"318","DOI":"10.1109\/TPAMI.2018.2858826","volume":"42","author":"TY Lin","year":"2018","unstructured":"Lin, T.Y., Goyal, P., Girshick, R., He, K., Doll\u00e1r, P.: Focal loss for dense object detection. IEEE Trans. Pattern Anal. Mach. Intell. 42(2), 318\u2013327 (2018)","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"3490_CR30","doi-asserted-by":"publisher","unstructured":"Loria, M.P., Toja, M., Carchiolo, V., Malgeri, M.: An efficient real-time architecture for collecting IoT data. In: 2017 Federated Conference on Computer Science and Information Systems (FedCSIS), pp. 1157\u20131166 (2017). https:\/\/doi.org\/10.15439\/2017F381","DOI":"10.15439\/2017F381"},{"key":"3490_CR31","doi-asserted-by":"publisher","DOI":"10.1016\/j.engappai.2018.06.006","author":"A Mart\u00edn Garc\u00eda","year":"2018","unstructured":"Mart\u00edn Garc\u00eda, A., Rodriguez-Fernandez, V., Camacho, D.: CANDYMAN: classifying Android malware families by modelling dynamic traces with Markov chains. Eng. Appl. Artif. Intell. (2018). https:\/\/doi.org\/10.1016\/j.engappai.2018.06.006","journal-title":"Eng. Appl. Artif. Intell."},{"key":"3490_CR32","unstructured":"McAfee: McAfee mobile threat report. https:\/\/www.mcafee.com\/content\/dam\/consumer\/en-us\/docs\/2020-Mobile-Threat-Report.pdf. Accessed 2020"},{"key":"3490_CR33","doi-asserted-by":"publisher","unstructured":"McLaughlin, N., Martinez del Rincon, J., Kang, B., Yerima, S., Miller, P., Sezer, S., Safaei, Y., Trickel, E., Zhao, Z., Doup\u00e9, A., Joon Ahn, G.: Deep Android malware detection. In: Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, CODASPY \u201917, pp. 301\u2013308. Association for Computing Machinery, New York (2017). https:\/\/doi.org\/10.1145\/3029806.3029823","DOI":"10.1145\/3029806.3029823"},{"key":"3490_CR34","doi-asserted-by":"publisher","DOI":"10.1145\/3313391","author":"L Onwuzurike","year":"2019","unstructured":"Onwuzurike, L., Mariconti, E., Andriotis, P., Cristofaro, E.D., Ross, G., Stringhini, G.: MaMaDroid: detecting Android malware by building Markov chains of behavioral models (extended version). ACM Trans. Priv. Secur. (2019). https:\/\/doi.org\/10.1145\/3313391","journal-title":"ACM Trans. Priv. Secur."},{"key":"3490_CR35","unstructured":"Prabhu, T.N.: Exploratory data analysis in Python. https:\/\/towardsdatascience.com\/exploratory-data-analysis-in-python-c9a77dfa39ce. Accessed 2020"},{"issue":"1","key":"3490_CR36","doi-asserted-by":"publisher","first-page":"93","DOI":"10.1109\/TCBB.2018.2829760","volume":"16","author":"MN Sadat","year":"2019","unstructured":"Sadat, M.N., Al Aziz, M.M., Mohammed, N., Chen, F., Jiang, X., Wang, S.: SAFETY: Secure gwAs in Federated Environment through a hYbrid Solution. IEEE\/ACM Trans. Comput. Biol. Bioinform. 16(1), 93\u2013102 (2019). https:\/\/doi.org\/10.1109\/TCBB.2018.2829760","journal-title":"IEEE\/ACM Trans. Comput. Biol. Bioinform."},{"key":"3490_CR37","doi-asserted-by":"publisher","unstructured":"Sanyal, S., Wu, D., Nour, B.: A federated filtering framework for internet of medical things. In: ICC 2019\u20142019 IEEE International Conference on Communications (ICC), pp. 1\u20136 (2019). https:\/\/doi.org\/10.1109\/ICC.2019.8761381","DOI":"10.1109\/ICC.2019.8761381"},{"key":"3490_CR38","doi-asserted-by":"publisher","unstructured":"Shih, C., Chuang, C., Yeh, H.: Federating public and private intelligent services for IoT applications. In: 2017 13th International Wireless Communications and Mobile Computing Conference (IWCMC), pp. 558\u2013563 (2017). https:\/\/doi.org\/10.1109\/IWCMC.2017.7986346","DOI":"10.1109\/IWCMC.2017.7986346"},{"key":"3490_CR39","doi-asserted-by":"publisher","unstructured":"Spreitzenbarth, M., Freiling, F., Echtler, F., Schreck, T., Hoffmann, J.: Mobile-sandbox: having a deeper look into Android applications. In: Proceedings of the 28th Annual ACM Symposium on Applied Computing, SAC \u201913, pp. 1808\u20131815. Association for Computing Machinery, New York (2013). https:\/\/doi.org\/10.1145\/2480362.2480701","DOI":"10.1145\/2480362.2480701"},{"key":"3490_CR40","doi-asserted-by":"publisher","unstructured":"Sruthi, V.M., Thanudas, B., Sreelal, S., Chakraborty, A., Manoj, B.S.: ACTM: API call transition matrix-based malware detection method. In: 2018 IEEE International Conference on Advanced Networks and Telecommunications Systems (ANTS), pp. 1\u20136 (2018). https:\/\/doi.org\/10.1109\/ANTS.2018.8710081","DOI":"10.1109\/ANTS.2018.8710081"},{"key":"3490_CR41","unstructured":"TechCrunch: 6.1B smartphone users globally by 2020, overtaking basic fixed phone subscriptions. https:\/\/techcrunch.com\/2015\/06\/02\/6-1b-smartphone-users-globally-by-2020-overtaking-basic-fixed-phone-subscriptions. Accessed 2020"},{"key":"3490_CR42","doi-asserted-by":"publisher","unstructured":"Vinayakumar, R., Soman, K.P., Poornachandran, P.: Deep Android malware detection and classification. In: 2017 International Conference on Advances in Computing, Communications and Informatics (ICACCI), pp. 1677\u20131683 (2017). https:\/\/doi.org\/10.1109\/ICACCI.2017.8126084","DOI":"10.1109\/ICACCI.2017.8126084"},{"key":"3490_CR43","doi-asserted-by":"publisher","unstructured":"Wang, H., Li, X., Ji, H., Zhang, H.: Federated offloading scheme to minimize latency in MEC-enabled vehicular networks. In: 2018 IEEE Globecom Workshops (GC Wkshps), pp. 1\u20136 (2018). https:\/\/doi.org\/10.1109\/GLOCOMW.2018.8644315","DOI":"10.1109\/GLOCOMW.2018.8644315"},{"key":"3490_CR44","doi-asserted-by":"publisher","unstructured":"Wei, F., li, Y., Roy, S., Ou, X., Zhou, W.: Deep ground truth analysis of current Android malware. pp. 252\u2013276 (2017). https:\/\/doi.org\/10.1007\/978-3-319-60876-1_12","DOI":"10.1007\/978-3-319-60876-1_12"},{"key":"3490_CR45","unstructured":"WEKA: WEKA 3\u2014data mining with open source machine learning software in Java. https:\/\/www.cs.waikato.ac.nz\/ml\/weka\/. Accessed 2020"},{"key":"3490_CR46","unstructured":"Weng, J.: Exploratory data analysis: a practical guide and template for structured data. https:\/\/towardsdatascience.com\/exploratory-data-analysis-eda-a-practical-guide-and-template-for-structured-data-abfbf3ee3bd9. Accessed 2020"},{"key":"3490_CR47","doi-asserted-by":"publisher","unstructured":"Xie, N., Zeng, F., Qin, X., Zhang, Y., Zhou, M., Lv, C.: RepassDroid: automatic detection of Android malware based on essential permissions and semantic features of sensitive APIs. In: 2018 International Symposium on Theoretical Aspects of Software Engineering (TASE), pp. 52\u201359 (2018). https:\/\/doi.org\/10.1109\/TASE.2018.00015","DOI":"10.1109\/TASE.2018.00015"},{"key":"3490_CR48","doi-asserted-by":"publisher","unstructured":"Yang, S.: An image-inspired and CNN-based Android malware detection approach. In: Proceedings of the 34th IEEE\/ACM International Conference on Automated Software Engineering, ASE \u201919, pp. 1259\u20131261. IEEE Press (2019). https:\/\/doi.org\/10.1109\/ASE.2019.00155","DOI":"10.1109\/ASE.2019.00155"}],"container-title":["Cluster Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10586-021-03490-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10586-021-03490-2\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10586-021-03490-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,7,14]],"date-time":"2022-07-14T11:33:27Z","timestamp":1657798407000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10586-021-03490-2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,4]]},"references-count":48,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2022,8]]}},"alternative-id":["3490"],"URL":"https:\/\/doi.org\/10.1007\/s10586-021-03490-2","relation":{},"ISSN":["1386-7857","1573-7543"],"issn-type":[{"value":"1386-7857","type":"print"},{"value":"1573-7543","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,2,4]]},"assertion":[{"value":"29 June 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 October 2021","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"24 November 2021","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 February 2022","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This article does not contain any studies with human participants or animals performed by any of the authors.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}},{"value":"Informed consent was obtained from all individual participants included in the study.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Informed consent"}}]}}