Android Botnet Detection using Convolutional Neural Networks

Abstract

Today, Android devices are able to provide various services. They support applications for different purposes such as entertainment, business, health, education, and banking services. Because of the functionality and popularity of Android devices as well as the open-source policy of Android OS, they have become a suitable target for attackers. Android Botnet is one of the most dangerous malwares because an attacker called Botmaster can control that remotely to perform destructive attacks. A number of researchers have used different well-known Machine Learning (ML) methods to recognize Android Botnets from benign applications. However, these conventional methods are not able to detect new sophisticated Android Botnets. In this paper, we propose a novel method based on Android permissions and Convolutional Neural Networks (CNNs) to classify Botnets and benign Android applications.Being the first developed method that uses CNNs for this aim, we also proposed a novel method to represent each application as an image which is constructed based on the co-occurrence of used permissions in that application. The proposed CNN is a binary classifier that is trained using these images. Evaluating the proposed method on 5450 Android applications consist of Botnet and benign samples, the obtained results show the accuracy of 97.2% and recall of 96% which is a promising result just using Android permissions.

Using Ensemble Learning Technique for Detecting Botnet on IoT

“…[9] NB, BN, & DT 98.00 [10] Not ML method 99.00 [11] ANN, SVM, k-NN, NB, & GBM 97.00 [12] k-NN, DT, & RF 70.00 [13] ANN, SVM, NB, DT, RF, LR. & BNet 99.47 [14] NB & DT 97.00 [15] DT 99.00 [16] K-means 82.10 [17] DT 97.00 [18] RF 86.41 [19] ANN, SVM, & NB 93.90 [44] Not ML method 99.82 [20] k-NN & RF 91.10 [21] ANN 97.87 [22] DT 90.40 [23] DT 99.46 [24] ANN, SVM, & k-NN 99.00 [45] Not ML method 95.50 [46] Not ML method 99.68 [25] SVM & ANN 94.00 [47] Not ML method 99.70 [26] DT & ANN 99.20 [48] Not ML method 99.00 [27] KNN, SVM, DT, RF, & ANN 99.00 [28] SVM 99.15 [29] k-NN 94.00 [49] Not ML method 96.20 [50] Not ML method 99.35 [51] Not ML method 92.92 [52] Not ML method 98.70 [53] Not ML method 97.00 [54] Not ML method 98.70 [55] Not ML method *100 [56] Not ML method 99.94 [57] Not ML method 99.60 [58] Not ML method 98.60 [59] Not ML method 97.20 [30] k-NN, NB, DT, RF, & SVM 91.80 [31] ANN 99.60 This research LR, LR, DT, NB, k-NN, RF, GBM, SVM, K-means, K-medians, mini batch, HC, ANN, DBSCAN, GMM, LAC, AP, and ensemble learning…”

Deep Learning Techniques for Android Botnet Detection

“…Some of the more recent machine learning based Android botnet detection work, such as ref. [6] and ref. [7] have focused on deep learning.…”

“…In ref. [6], Android botnet detection based on CNN and using permissions as features was proposed. In the proposed method, apps are represented as images that are constructed based on the co-occurrence of permissions used within the applications.…”

“…Unlike in ref. [6], 1D CNN was used and the model was evaluated with the 1929 ISCX botnet apps and 4873 benign apps resulting in 98.9% accuracy, 0.978 recall, 0.983 precision, and 0.981 F1-score.…”

AdvAndMal: Adversarial Training for Android Malware Detection and Family Classification

“…The feature representation methods can transform the task of malware detection into image classification, and use advanced techniques and models in the image field to detect and analyze the malicious behaviors of the application. The characteristic image representation types of malware mainly include RGB color image [23], binary(black and white) image [24] and gray-scale image [25].…”