Behavior Intention Derivation of Android Malware Using Ontology Inference

Table 2

Specification of object attributes and data attributes.

Attribute name	Specification
hasCombinationwith	Behaviors have combination relation
hasCompoundwith	Behaviors have compound relation
hasInput(x, y)	The behavior’s single input is “y”
hasOutput(x, z)	The behavior’s single output is “z”
hasFirstInput(x, y1)	The first input of double input is “y1”
hasSecondInput(x, y2)	The second input of double input is “y2”
hasFirstOutput(x, z1)	The first output of double input is “z1”
hasSecondOutput(x, z2)	The second output of double input is “z2”
hasBehavior(x, y)	The behavior belonging to malware is “y”
hasObjectName(x, y)	The name of the object is “y”
hasAttribute(x, y)	The attributes of an object are “y”
hasAttributeValue(x, y)	The object’s attributes value is “y”