Detection of iOS Malware apps based on Significant Services Identification using Borda count

In today's era, smartphones are used in daily lives because they are ubiquitous and provide internet connectivity everywhere. The primary reason for the increased usage of smartphones is their functional expandability by installing third-party apps, which span a wide range of categories including books, social networking, instant messaging, etc. Users are compelled to use these feature-rich apps. As a result, the menaces because of these apps, which are potentially risky for user's privacy, have increased. As the information on smartphones is perhaps, more personal than compared to data stored on desktops or computers because smartphones remain with individuals throughout the day and generate contextual data through sensors making it an easy target for intruders. Both Android and iOS follow a permission-based access control mechanism to protect the privacy of their users where an app has to specify the permissions it will use during its run-time. However, the users are unaware whether the app is breaching the user's privacy or sharing it with third-party apps. A lot of work for detecting malicious Android apps using feature selection techniques has been conducted because of the availability of a large permission set and labeled data set. However, minimal work has been conducted for the iOS platform because of the limited permission set, limited labeled data set, and closed-source platform. To combat this problem, in the paper we propose an approach to detect malicious iOS apps based on the app's category using static analysis of app permissions to identify the most significant permission. In this work, several feature ranking techniques such as Correlation, Gain ratio, Info gain, OneR, and ReliefF have been employed on a data set of 1150 iOS apps to identify the riskiest permission across 12 different app categories. To improve the permission selection process and improve the precision of classifiers, the Borda count method has been utilized. Our empirical analysis proves that the proposed approach effectively identifies the top 5 risky permissions within different categories.