Behavior Intention Derivation of Android Malware Using Ontology Inference

Box 1

Rule-1: behavior_B1(?B11) ∧ behavior_B1(?B12) ∧ has

BehaviorName(?B11, ?bn1)∧hasBehaviorName (?B12, ?bn2)

∧ hasOutput(?B11,?op) ∧ hasInput(?B12,?ip)∧ hasObject

name(?op, ?on1) ∧ hasObjectname(?ip, ?on2)∧swrlb:equal

(?on1,?on2) ∧ hasAttribute(?op, ?att1) ∧ has Attribute

(?ip, ?att2) ∧ hasValue(?att1, ?attri1) ∧ hasValue

(?att2, ?attri2) ∧ swrlb:equal (?attri1, ?attri2) ∧ hasAttribute

Value(?op,?attv1) ∧ hasAttributeValue (?ip, ?attv2) ∧ hasValue

(?attv1, ?attriv1) ∧ hasValue(?attv2,?attriv2) ∧ swrlb:equal

(?attriv1,?attriv2) → hasCompoundwith(?bn1, ?bn2).