\newcommand{\daNumSigModels}{17}
\newcommand{\daSigNumDevices}{100}
\newcommand{\daSigNumDeviceDays}{10\,000}
\newcommand{\daSigNumDays}{100}
\newcommand{\daSigNumDevicesDay}{20}
\newcommand{\daSigVersionPerc}{1\%}
\newcommand{\daSigVersionDays}{10}
\newcommand{\daNumVulnsUsed}{11}
\newcommand{\daNumDeviceDataDevices}{50}
\newcommand{\daOSYearsOfData}{3}
\newcommand{\daOSMonthsOfData}{47}
\newcommand{\daStartDate}{2011-07-01}
\newcommand{\daEndDate}{2015-05-18}
\newcommand{\daFullDeployedAt}{95\%}
\newcommand{\daNumManufacturers}{298}
\newcommand{\daNumSigManufacturers}{8}
\newcommand{\daNumModels}{2\,690}
\newcommand{\daNumOperators}{1\,440}
\newcommand{\daNumSigOperators}{14}
\newcommand{\daNumOSDevices}{20\,300}
\newcommand{\daOSVersionPercValidLines}{99.7\%}
\newcommand{\daOSTotalDaysData}{1\,290\,000}
\newcommand{\daMeanInsecurityPercNominal}{87.9\%}
\newcommand{\daMeanInsecurityPerc}{$87.9 \pm 0.0\%$}
\newcommand{\daMeanInsecurityPercTwosfNominal}{88\%}
\newcommand{\daMeanInsecurityPercTwosf}{$88 \pm 0\%$}
\newcommand{\daMeanSecurityPercNominal}{12.1\%}
\newcommand{\daMeanSecurityPerc}{$12.1 \pm 0.0\%$}
\newcommand{\daMeanSecurityPercTwosfNominal}{12\%}
\newcommand{\daMeanSecurityPercTwosf}{$12 \pm 0\%$}
\newcommand{\daVulnFreeNominal}{0.121}
\newcommand{\daVulnFree}{$0.121 \pm 0.000$}
\newcommand{\daMeanOutstandingVulnerabilities}{0.552}
\newcommand{\daUpdatednessNominal}{0.0513}
\newcommand{\daUpdatedness}{$0.0513 \pm 0.0002$}
\newcommand{\daUpdatednessPercNominal}{5.13\%}
\newcommand{\daUpdatednessPerc}{$5.13 \pm 0.02\%$}
\newcommand{\daUpdatednessPercTwosfNominal}{5.1\%}
\newcommand{\daUpdatednessPercTwosf}{$5.1 \pm 0.0\%$}
\newcommand{\daSecurityScoreNominal}{2.83}
\newcommand{\daSecurityScore}{$2.83 \pm 0.00$}
\newcommand{\daCurrentMeanInsecurityPercNominal}{87.3\%}
\newcommand{\daCurrentMeanInsecurityPerc}{$87.3 \pm 5.0\%$}
\newcommand{\daCurrentMeanInsecurityPercTwosfNominal}{87\%}
\newcommand{\daCurrentMeanInsecurityPercTwosf}{$87 \pm 5\%$}
\newcommand{\daCurrentMeanSecurityPercNominal}{12.7\%}
\newcommand{\daCurrentMeanSecurityPerc}{$12.7 \pm 5.0\%$}
\newcommand{\daCurrentMeanSecurityPercTwosfNominal}{13\%}
\newcommand{\daCurrentMeanSecurityPercTwosf}{$13 \pm 5\%$}
\newcommand{\daCurrentVulnFreeNominal}{0.127}
\newcommand{\daCurrentVulnFree}{$0.127 \pm 5.07e$}
\newcommand{\daCurrentMeanOutstandingVulnerabilities}{0.22}
\newcommand{\daCurrentUpdatednessNominal}{0.0335}
\newcommand{\daCurrentUpdatedness}{$0.0335 \pm 0.0005$}
\newcommand{\daCurrentUpdatednessPercNominal}{3.35\%}
\newcommand{\daCurrentUpdatednessPerc}{$3.35 \pm 0.05\%$}
\newcommand{\daCurrentUpdatednessPercTwosfNominal}{3.3\%}
\newcommand{\daCurrentUpdatednessPercTwosf}{$3.3 \pm 0.0\%$}
\newcommand{\daCurrentSecurityScoreNominal}{3.28}
\newcommand{\daCurrentSecurityScore}{$3.28 \pm 0.00$}
\newcommand{\daDailyParticipationNominal}{907}
\newcommand{\daDailyParticipation}{$907 \pm 223$}
\newcommand{\daNumFullVersions}{1\,250}
\newcommand{\daNumSigFullVersions}{94}
\newcommand{\daNumOSVersions}{50}
\newcommand{\daNumSigOSVersions}{27}
\newcommand{\daNumAPIVersions}{16}
\newcommand{\daNumFullVersionUpdates}{4\,520}
\newcommand{\daNumOSVersionUpdates}{3\,830}
\newcommand{\daUpdatesPerYearNominal}{1.28}
\newcommand{\daUpdatesPerYear}{$1.28 \pm 0.01$}
\newcommand{\daUpdatesPerYearTwosfNominal}{1.3}
\newcommand{\daUpdatesPerYearTwosf}{$1.3 \pm 0.0$}
\newcommand{\daNumFullOnlyVersionUpdates}{672}
\newcommand{\daNumSecurityUpdates}{1\,240}
\newcommand{\daNumPossibleSecurityUpdates}{2\,280}
\newcommand{\daOSCurveFitParamFirst}{84.9}
\newcommand{\daOSCurveFitParamSecond}{\num{0.00291}}
\newcommand{\daOSCurveFitRMSE}{0.116}
\newcommand{\daOSCurvePolyRMSE}{0.116}
\newcommand{\daOSCurveSplineRMSE}{0.116}
\newcommand{\daOSCurveHalfDeployedYearsNominal}{0.886}
\newcommand{\daOSCurveHalfDeployedYears}{$0.886 \pm 0.248$}
\newcommand{\daOSCurveHalfDeployedNominal}{323}
\newcommand{\daOSCurveHalfDeployed}{$323 \pm 90$}
\newcommand{\daOSCurveFullDeployedYearsNominal}{3.06}
\newcommand{\daOSCurveFullDeployedYears}{$3.06 \pm 69$}
\newcommand{\daOSCurveFullDeployedNominal}{1\,120}
\newcommand{\daOSCurveFullDeployed}{$1\,120 \pm 255\,000$}
\newcommand{\daAPICurveFitParamFirst}{102}
\newcommand{\daAPICurveFitParamSecond}{\num{0.0029}}
\newcommand{\daAPICurveFitRMSE}{0.113}
\newcommand{\daAPICurvePolyRMSE}{0.114}
\newcommand{\daAPICurveSplineRMSE}{0.114}
\newcommand{\daAPICurveHalfDeployedYearsNominal}{0.933}
\newcommand{\daAPICurveHalfDeployedYears}{$0.933 \pm 0.242$}
\newcommand{\daAPICurveHalfDeployedNominal}{340}
\newcommand{\daAPICurveHalfDeployed}{$340 \pm 88$}
\newcommand{\daAPICurveFullDeployedYearsNominal}{3.1}
\newcommand{\daAPICurveFullDeployedYears}{$3.1 \pm 6$}
\newcommand{\daAPICurveFullDeployedNominal}{1\,130}
\newcommand{\daAPICurveFullDeployed}{$1\,130 \pm 255\,000$}
\newcommand{\daVulnAPKDuplicateFileOctoberPerc}{91.6\%}
\newcommand{\daVulnZergRushMonthsDefFixDeployed}{27.3}
\newcommand{\daTabSecScoresmanufacturer}{\begin{table} \centering \begin{tabular}{l|c|c|c|c} Name & $f$ & $u$ & $m$ & \textbf{score} \\ &&&& (out of 10) \\ \hline LG & $0.20 \pm 0.00$ & $0.32 \pm 0.00$ & 0.64 & $3.83 \pm 0.01$ \\  Motorola & $0.17 \pm 0.00$ & $0.13 \pm 0.00$ & 0.73 & $3.02 \pm 0.01$ \\  Samsung & $0.13 \pm 0.00$ & $0.04 \pm 0.00$ & 0.63 & $2.71 \pm 0.00$ \\  Sony & $0.13 \pm 0.00$ & $0.19 \pm 0.00$ & 1.09 & $2.61 \pm 0.01$ \\  HTC & $0.14 \pm 0.00$ & $0.09 \pm 0.00$ & 0.89 & $2.57 \pm 0.00$ \\  asus & $0.19 \pm 0.00$ & $0.52 \pm 0.01$ & 6.01 & $2.31 \pm 0.02$ \\  other & $0.06 \pm 0.00$ & $0.04 \pm 0.00$ & 1.04 & $1.94 \pm 0.00$ \\  Symphony & $0.00 \pm 0.00$ & $0.07 \pm 0.00$ & 5.00 & $0.27 \pm 0.01$ \\  walton & $0.00 \pm 0.00$ & $0.07 \pm 0.00$ & 5.99 & $0.24 \pm 0.01$ \\ \end{tabular} \caption{Security scores for manufacturers} \label{tab:sec_manufacturer} \end{table}}
\newcommand{\daSecScoreBestmanufacturer}{LG}
\newcommand{\daSecScoreBestmanufacturerScoreNominal}{3.83}
\newcommand{\daSecScoreBestmanufacturerScore}{$3.83 \pm 0.01$}
\newcommand{\daSecScoreBestmanufacturerNumFullVersions}{129}
\newcommand{\daSecScoreWorstmanufacturer}{walton}
\newcommand{\daSecScoreWorstmanufacturerScoreNominal}{0.236}
\newcommand{\daSecScoreWorstmanufacturerScore}{$0.236 \pm 0.007$}
\newcommand{\daSecScoreWorstmanufacturerNumFullVersions}{22}
\newcommand{\daTabSecScoresmodel}{\begin{table} \centering \begin{tabular}{l|c|c|c|c} Name & $f$ & $u$ & $m$ & \textbf{score} \\ &&&& (out of 10) \\ \hline Galaxy Nexus & $0.51 \pm 0.00$ & $0.55 \pm 0.01$ & 1.53 & $4.74 \pm 0.03$ \\  Nexus 4 & $0.28 \pm 0.00$ & $0.82 \pm 0.01$ & 6.06 & $3.58 \pm 0.04$ \\  Nexus 7 & $0.24 \pm 0.00$ & $0.74 \pm 0.01$ & 5.92 & $3.17 \pm 0.04$ \\  other & $0.09 \pm 0.00$ & $0.14 \pm 0.00$ & 0.55 & $2.97 \pm 0.00$ \\  Desire HD & $0.08 \pm 0.00$ & $0.05 \pm 0.00$ & 0.39 & $2.91 \pm 0.01$ \\  HTC Sensation & $0.35 \pm 0.00$ & $0.01 \pm 0.01$ & 1.59 & $2.42 \pm 0.02$ \\  GT-I9100 & $0.22 \pm 0.00$ & $0.02 \pm 0.00$ & 1.23 & $2.28 \pm 0.01$ \\  HTC Desire S & $0.02 \pm 0.00$ & $0.02 \pm 0.00$ & 1.00 & $1.75 \pm 0.01$ \\  GT-N7000 & $0.25 \pm 0.00$ & $0.00 \pm 0.00$ & 2.52 & $1.43 \pm 0.02$ \\  GT-P1000 & $0.01 \pm 0.00$ & $0.00 \pm 0.01$ & 1.79 & $0.90 \pm 0.02$ \\  GT-I9300 & $0.13 \pm 0.00$ & $0.01 \pm 0.00$ & 6.25 & $0.59 \pm 0.01$ \\  GT-I9505 & $0.01 \pm 0.00$ & $0.13 \pm 0.00$ & 6.82 & $0.44 \pm 0.01$ \\  HTC Desire HD & $0.00 \pm 0.00$ & $0.00 \pm 0.01$ & 3.05 & $0.27 \pm 0.02$ \\  GT-N7100 & $0.06 \pm 0.00$ & $0.00 \pm 0.01$ & 6.91 & $0.25 \pm 0.02$ \\  Symphony W68 & $0.00 \pm 0.00$ & $0.00 \pm 0.01$ & 11.00 & $0.00 \pm 0.03$ \\ \end{tabular} \caption{Security scores for models} \label{tab:sec_model} \end{table}}
\newcommand{\daSecScoreBestmodel}{Galaxy Nexus}
\newcommand{\daSecScoreBestmodelScoreNominal}{4.74}
\newcommand{\daSecScoreBestmodelScore}{$4.74 \pm 0.02$}
\newcommand{\daSecScoreBestmodelNumFullVersions}{49}
\newcommand{\daSecScoreWorstmodel}{Symphony W68}
\newcommand{\daSecScoreWorstmodelScoreNominal}{0.0001}
\newcommand{\daSecScoreWorstmodelScore}{$0.0001 \pm 0.0276$}
\newcommand{\daSecScoreWorstmodelNumFullVersions}{1}
\newcommand{\daTabSecScoressummary}{\begin{table} \centering \begin{tabular}{l|c|c|c|c} Name & $f$ & $u$ & $m$ & \textbf{score} \\ &&&& (out of 10) \\ \hline nexus & $0.38 \pm 0.00$ & $0.48 \pm 0.00$ & 0.59 & $5.08 \pm 0.01$ \\  notnexus & $0.10 \pm 0.00$ & $0.02 \pm 0.00$ & 0.55 & $2.66 \pm 0.00$ \\ \end{tabular} \caption{Security scores for nexus} \label{tab:sec_summary} \end{table}}
\newcommand{\daTabSecScoresoperator}{\begin{table} \centering \begin{tabular}{l|c|c|c|c} Name & $f$ & $u$ & $m$ & \textbf{score} \\ &&&& (out of 10) \\ \hline O2 uk & $0.26 \pm 0.00$ & $0.12 \pm 0.00$ & 0.37 & $3.84 \pm 0.01$ \\  T-Mobile & $0.21 \pm 0.00$ & $0.18 \pm 0.00$ & 0.42 & $3.73 \pm 0.01$ \\  Orange & $0.21 \pm 0.00$ & $0.09 \pm 0.00$ & 0.39 & $3.53 \pm 0.02$ \\  Sprint & $0.18 \pm 0.00$ & $0.11 \pm 0.00$ & 0.40 & $3.46 \pm 0.01$ \\  3 & $0.18 \pm 0.00$ & $0.09 \pm 0.00$ & 0.52 & $3.22 \pm 0.01$ \\  Vodafone uk & $0.13 \pm 0.00$ & $0.13 \pm 0.00$ & 0.50 & $3.18 \pm 0.01$ \\  AT\&T & $0.12 \pm 0.00$ & $0.08 \pm 0.00$ & 0.43 & $3.09 \pm 0.01$ \\  Verizon & $0.18 \pm 0.00$ & $0.09 \pm 0.00$ & 0.82 & $2.83 \pm 0.01$ \\  unknown & $0.11 \pm 0.00$ & $0.20 \pm 0.00$ & 0.87 & $2.80 \pm 0.01$ \\  n Telenor & $0.03 \pm 0.00$ & $0.12 \pm 0.00$ & 1.26 & $1.81 \pm 0.01$ \\  Airtel & $0.05 \pm 0.00$ & $0.03 \pm 0.00$ & 1.62 & $1.27 \pm 0.01$ \\  Robi & $0.00 \pm 0.00$ & $0.07 \pm 0.00$ & 2.08 & $0.88 \pm 0.01$ \\  Grameenphone & $0.00 \pm 0.00$ & $0.05 \pm 0.00$ & 2.02 & $0.86 \pm 0.00$ \\  banglalink & $0.00 \pm 0.00$ & $0.04 \pm 0.00$ & 2.62 & $0.53 \pm 0.01$ \\ \end{tabular} \caption{Security scores for operators} \label{tab:sec_operator} \end{table}}
\newcommand{\daSecScoreBestoperator}{O2 uk}
\newcommand{\daSecScoreBestoperatorScoreNominal}{3.84}
\newcommand{\daSecScoreBestoperatorScore}{$3.84 \pm 0.01$}
\newcommand{\daSecScoreBestoperatorNumFullVersions}{96}
\newcommand{\daSecScoreWorstoperator}{banglalink}
\newcommand{\daSecScoreWorstoperatorScoreNominal}{0.528}
\newcommand{\daSecScoreWorstoperatorScore}{$0.528 \pm 0.005$}
\newcommand{\daSecScoreWorstoperatorNumFullVersions}{73}
\newcommand{\daTabDLDistances}{\begin{table} \centering \begin{tabular}{l|c|c|c|c} & manufacturer & model & operator & summary \\ \hline equal & 0.0 & 0.0 & 0.0714 & 0.0 \\weight $m$ & 0.222 & 0.333 & 0.143 & 0.0 \\weight $u$ & 0.444 & 0.0667 & 0.214 & 0.0 \\$f$ & 0.444 & 0.6 & 0.429 & 0.0 \\$m$ & 0.667 & 0.733 & 0.357 & 0.5 \\$u$ & 0.889 & 0.667 & 0.714 & 0.0 \\\end{tabular} \caption{Normalised Damerau-Levenshtein distances for different metrics} \label{tab:dl_distances} \end{table}}
\newcommand{\daTabChangeInScores}{\begin{table*} \centering \begin{tabular}{l|c|c|c|c} & manufacturer & model & operator & summary \\ \hline $m$ & $-1.91 \pm 2.21$ & $-0.667 \pm 2.49$ & $-3.26 \pm 1.38$ & $-3.35 \pm 1.84$ \\weight $m$ & $-0.295 \pm 0.273$ & $-0.102 \pm 0.313$ & $-0.458 \pm 0.176$ & $-0.485 \pm 0.209$ \\equal & $-0.116 \pm 0.065$ & $-0.0392 \pm 0.112$ & $-0.146 \pm 0.048$ & $-0.166 \pm 0.028$ \\weight $u$ & $-0.0523 \pm 0.127$ & $-0.0156 \pm 0.24$ & $0.0198 \pm 0.0788$ & $-0.0143 \pm 0.128$ \\$u$ & $0.518 \pm 1.6$ & $0.197 \pm 2.14$ & $1.51 \pm 0.95$ & $1.35 \pm 1.52$ \\$f$ & $1.04 \pm 0.58$ & $0.352 \pm 1.01$ & $1.31 \pm 0.43$ & $1.5 \pm 0.2$ \\\end{tabular} \caption{Mean change in scores for different metrics} \label{tab:change_in_scores} \end{table*}}
\newcommand{\daGPAPICurveFitParamFirst}{80.7}
\newcommand{\daGPAPICurveFitParamSecond}{\num{0.0026}}
\newcommand{\daGPAPICurveFitRMSE}{0.182}
\newcommand{\daGPAPICurvePolyRMSE}{0.182}
\newcommand{\daGPAPICurveSplineRMSE}{0.182}
\newcommand{\daGPAPICurveHalfDeployedYearsNominal}{0.95}
\newcommand{\daGPAPICurveHalfDeployedYears}{$0.95 \pm 0.47$}
\newcommand{\daGPAPICurveHalfDeployedNominal}{347}
\newcommand{\daGPAPICurveHalfDeployed}{$347 \pm 174$}
\newcommand{\daGPAPICurveFullDeployedYearsNominal}{3.37}
\newcommand{\daGPAPICurveFullDeployedYears}{$3.37 \pm 78$}
\newcommand{\daGPAPICurveFullDeployedNominal}{1\,230}
\newcommand{\daGPAPICurveFullDeployed}{$1\,230 \pm 285\,000$}
\newcommand{\daGPAPIPerAPIMeanNominal}{0.00448}
\newcommand{\daGPAPIPerAPIMean}{$0.00448 \pm 0.00333$}
\newcommand{\daGPAPIPerAPIStdevNominal}{0.0213}
\newcommand{\daGPAPIPerAPIStdev}{$0.0213 \pm 0.0128$}
\newcommand{\daGPAPIPerAPIAbsMeanNominal}{0.0146}
\newcommand{\daGPAPIPerAPIAbsMean}{$0.0146 \pm 0.0068$}
\newcommand{\daGPAPIPerAPIAbsStdevNominal}{0.0155}
\newcommand{\daGPAPIPerAPIAbsStdev}{$0.0155 \pm 0.0121$}
\newcommand{\daGPAPIPerAPIParametersTable}{\begin{table} \centering \begin{tabular}{c|S|S} API Version & ${t_0}$ & $\mathrm{decay}$ \\ \hline2	&	0.0	&	0.0237\\3	&	0.0	&	0.0235\\4	&	0.0	&	0.00689\\5	&	59.1	&	0.00465\\6	&	2.4	&	0.00434\\7	&	0.0	&	0.00499\\8	&	47.7	&	0.00415\\9	&	155	&	0.00365\\10	&	90.2	&	0.00364\\11	&	432	&	0.00228\\12	&	355	&	0.00228\\13	&	304	&	0.00235\\14	&	218	&	0.00239\\15	&	160	&	0.00239\\16	&	141	&	0.00226\\17	&	275	&	0.00186\\18	&	118	&	0.0014\\19	&	119	&	0.00152\\\end{tabular} \caption{Parameters for different API versions} \label{tab:per_api_parameters} \end{table}}
\newcommand{\daGPAPISeventeenLaterDate}{2015-04-06}
\newcommand{\daGPAPISeventeenLaterProportion}{70.6\%}
\newcommand{\daGPAPISeventeenEarlierProportion}{29.4\%}
\newcommand{\daAPISeventeenReleaseDate}{2012-10-29}
\newcommand{\daGPAPISeventeenFullDeployment}{2017-12-27}
\newcommand{\daGPAPISeventeenCurveFitParamFirst}{275}
\newcommand{\daGPAPISeventeenCurveFitParamSecond}{\num{0.00186}}
\newcommand{\daGPAPISeventeenCurveFitRMSE}{0.0282}
\newcommand{\daGPAPISeventeenCurvePolyRMSE}{0.00903}
\newcommand{\daGPAPISeventeenCurveSplineRMSE}{0.00903}
\newcommand{\daGPAPISeventeenCurveHalfDeployedYearsNominal}{1.77}
\newcommand{\daGPAPISeventeenCurveHalfDeployedYears}{$1.77 \pm 0.08$}
\newcommand{\daGPAPISeventeenCurveHalfDeployedNominal}{647}
\newcommand{\daGPAPISeventeenCurveHalfDeployed}{$647 \pm 31$}
\newcommand{\daGPAPISeventeenCurveFullDeployedYearsNominal}{5.17}
\newcommand{\daGPAPISeventeenCurveFullDeployedYears}{$5.17 \pm 1.23$}
\newcommand{\daGPAPISeventeenCurveFullDeployedNominal}{1\,890}
\newcommand{\daGPAPISeventeenCurveFullDeployed}{$1\,890 \pm 447$}
\newcommand{\daNumUpdatesUpgrades}{3\,590}
\newcommand{\daUpdatesPerMonthPerVersionNominal}{2.83}
\newcommand{\daUpdatesPerMonthPerVersion}{$2.83 \pm 0.04$}
\newcommand{\daNumUpdatesSkippedBig}{3}
\newcommand{\daNumUpdatesBigUpgrades}{819}
\newcommand{\daNumUpdatesDowngrades}{152}
\newcommand{\daNumUpdateFullOnly}{669}
\newcommand{\daPercBigUpgradesNominal}{18.6\%}
\newcommand{\daPercBigUpgrades}{$18.6 \pm 0.7\%$}
\newcommand{\daPercUpdatesDowngradesNominal}{3.45\%}
\newcommand{\daPercUpdatesDowngrades}{$3.45 \pm 0.28\%$}
\newcommand{\daNumDataPoints}{156 Billion}
\newcommand{\daMonthsDevices}{1\,780}
\newcommand{\daMonths}{6}
\newcommand{\daAdbEnabledPercNominal}{19.2\%}
\newcommand{\daAdbEnabledPerc}{$19.2 \pm 0.0\%$}
\newcommand{\daNumStartedApps}{126\,000}
\newcommand{\daNumInstalledApps}{180\,000}
