No abstract

No abstract

The popularity and adoption of Android smartphones has attracted malware authors to spread the malware to smartphone users. The malware on smartphone comes in various forms such as Trojans, viruses, worms and mobile botnet. However, mobile botnet or Android botnet are more dangerous since they pose serious threats by stealing user credential information, distributing spam and sending distributed denial of service (DDoS) attacks. Mobile botnet is defined as a collection of compromised mobile smartphones and controlled by a botmaster through a command and control (C&C) channel to serve a malicious purpose. Current research is still lacking in terms of their low detection rate due to their selected features. It is expected that a hybrid analysis could improve the detection rate. Therefore, machine learning methods and hybrid analysis which combines static and dynamic analyses were used to analyse and classify system calls, permission and API calls. The objective of this paper is to leverage machine learning techniques to classify the Android applications (apps) as botnet or benign. The experiment used malware dataset from the Drebin for the training and mobile applications from Google Play Store for testing. The results showed that Random Forest Algorithm achieved the highest accuracy rate of 97.9%. In future, more significant approach by using different feature selection such as intent, string and system component will be further explored for a better detection and accuracy rate.

No abstract

The increasing popularity of Android mobile phones in recent years has attracted the attention of malware developers. Android applications (apps) pose many risks/threats to the user's privacy and system integrity. Currently, permission-based models are used in the Android systems to detect the dangerous apps that possess several weaknesses. In this paper, a new risk assessment method is proposed to evaluate the amount of risk associated with every app in terms of privacy risk, financial risk, and smartphones system risk. It focused on the GPS exploitation for Android botnet detection. The assessment was based on static analysis that used features set permission and API calls. The quantitative calculation model was used as a method to differentiate between the benign and botnet apps. Every app was assessed for risk based on five categories such as Very High, High, Medium, Low and Very Low. Two datasets with 2694 Android botnet samples from Drebin and 774 benign apps from Google Play were used to evaluate the effectiveness of this method. The obtained results demonstrate that the proposed method is good in differentiating the Android botnet and benign apps based on the risk level. This will give a promising impression to the users during apps installation.