Malware Detection for Android TV

9 Pages Posted: 20 Mar 2024

See all articles by Gokhan Ozogur

Gokhan Ozogur

Arcelik A.S

Mehmet Ali Erturk

Istanbul University

Muhammed Ali AYDIN

Istanbul University - Cerrahpasa


Security of Android applications is a well-studied area in the literature but it is very limited for other types of devices like Android TVs. Android TVs are growing in popularity with advances in integrated services and gaming features, and are also attracting the attention of attackers. Although there is extensive literature on Android security for mobile devices, the literature on malware detection for Android TV devices is quite limited. In this study, we collected Android TV applications from markets and injected malicious payload into some of the benign applications to have Android TV malware which is hard to find in the market. We extracted n-grams from AndroidManifest.xml and binary source (classes.dex) files in Android TV application packages, and obtained 1000 features using the TF-IDF method. We publicly shared these features and class (benign or malicious) labels of the Android TV applications in spreadsheet format as a dataset for future studies. Also, we implemented 3 separate classification models using Extreme Gradient Boosting (XGBoost), Neural Network (NN) and Support Vector Machine (SVM) methods to compare their performance on this dataset for malware detection. We observed that XGBoost model perfomed better than NN and SVM models. XGBoost model classifies a TV application as malicious or benign in average of 0.0102 milliseconds with 97.31% F1-score and 94.62% MCC scores.

Keywords: Malware Detection, Smart TV, Android Application, Dataset

Suggested Citation

Ozogur, Gokhan and Erturk, Mehmet Ali and AYDIN, Muhammed Ali, Malware Detection for Android TV. Available at SSRN: or

Gokhan Ozogur (Contact Author)

Arcelik A.S ( email )


Mehmet Ali Erturk

Istanbul University ( email )

34459 Istanbul

Muhammed Ali AYDIN

Istanbul University - Cerrahpasa ( email )

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Abstract Views
PlumX Metrics