Android Malware Detection Based on Network Traffic Using Decision Tree Algorithm

Zulkifli, Aqil; Hamid, Isredza Rahmi A.; Shah, Wahidah Md; Abdullah, Zubaile

doi:10.1007/978-3-319-72550-5_46

Cited by 31 publications

(26 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…is said to belong to one side of the partition F with degree µ F (x) and to the other side with degree (1 − µ F (x)). Since both fuzzy rules [33] and decision tree [43], [44] yield good performance in malware analysis, we hybridize the idea behind these two methods by allowing fuzzy partitions of both types: (i) less than partition x < c, which is the fuzzy version of the ordinary partition for a continuous attribute:…”

Section: A Feature Selectionmentioning

confidence: 99%

Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

Wang

Liew

et al. 2021

IEEE Trans. Fuzzy Syst.

View full text Add to dashboard Cite

Classification of malicious software, especially in a very large dataset, is a challenging task for machine intelligence. Malware can have highly diversified features, each of which has highly heterogeneous distributions. These factors increase the difficulties for traditional data analytic approaches to deal with them. Although deep learning-based methods have reported good classification performance, the deep models usually lack interpretability and are fragile under adversarial attacks. To solve these problems, fuzzy systems have become a competitive candidate in malware analysis. In this paper, a new fuzzy-based approach is proposed for malware classification. We focused on portable executable files in the Windows platform and analyzed the distributions of static features and content-oriented features. Fuzzification was used to reduce the ubiquitous impact of noise and outliers in a very large dataset. Finally, a novel boosted classifier consisted of fuzzy decision trees and support vector machine is proposed to perform the malware classification. By using fuzzy decision trees, the inner structure of the classifier can be readily interpreted as discriminative rules, while the novel boosting strategy provides state-of-the-art classification performance. Extensive experimental results showed that our method significantly outperformed several state-of-the-art classifiers.

show abstract

Section: A Feature Selectionmentioning

confidence: 99%

Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

Wang

Liew

et al. 2021

IEEE Trans. Fuzzy Syst.

View full text Add to dashboard Cite

show abstract

“…CREDROID [35] identified malicious apps on the basis of Domain Name Server (DNS) queries and the data that are transmitted to remote servers. Zulkifli et al [36] proposed a method for detecting Android malware that is based on seven network traffic features and the J48 decision tree algorithm. Chen et al [37] introduced the imbalanced data gravitation-based classification algorithm for the classification of imbalanced data of malicious apps.…”

Section: Off-device Detectionmentioning

confidence: 99%

“…In our study, only network traffic is considered in Android malware detection. In contrast to previous network-based methods such as [14,[34][35][36], we do not need to model apps' network behaviors in advance, and our method is more useful in practice.…”

Section: Edge Computing Researchmentioning

confidence: 99%

On-Device Detection of Repackaged Android Malware via Traffic Clustering

Zhang

et al. 2020

Security and Communication Networks

View full text Add to dashboard Cite

Malware has become a significant problem on the Android platform. To defend against Android malware, researchers have proposed several on-device detection methods. Typically, these on-device detection methods are composed of two steps: (i) extracting the apps’ behavior features from the mobile devices and (ii) sending the extracted features to remote servers (such as a cloud platform) for analysis. By monitoring the behaviors of the apps that are running on mobile devices, available methods can detect suspicious applications (simply, apps) accurately. However, mobile devices are typically resource limited. The feature extraction and massive data transmission might consume substantial power and CPU resources; thus, the performance of mobile devices will be degraded. To address this issue, we propose a novel method for detecting Android malware by clustering apps’ traffic at the edge computing nodes. First, a new integrated architecture of the cloud, edge, and mobile devices for Android malware detection is presented. Then, for repackaged Android malware, the network traffic content and statistics are extracted at the edge as detection features. Finally, in the cloud, similarities between apps are calculated, and the similarity values are automatically clustered to separate the original apps and the malware. The experimental results demonstrate that the proposed method can detect repackaged Android malware with high precision and with a minimal impact on the performance of mobile devices.

show abstract

“…This section examines the present static feature work and the dynamic feature research. There are other classify malware based on a machine learning approach [22], [23]. Work by Leder et al [12] proposed a classification of metamorphic variants based on static features.…”

Section: Previous Work On Classification Techniquesmentioning

confidence: 99%

Classification of Polymorphic Virus Based on Integrated Features

Hamid

Subramaniam

Abdullah

2018

Int. J. Adv. Sci. Eng. Inf. Technol.

Self Cite

View full text Add to dashboard Cite

Standard virus classification relies on the use of virus function, which is a small number of bytes written in assembly language. The addressable problem with current malware intrusion detection and prevention system is having difficulties in detecting unknown and multipath polymorphic computer virus solely based on either static or dynamic features. Thus, this paper presents a classification of polymorphic virus based on integrated features. The integrated feature is selected based on Information Gain rank value between static and dynamic features. Then, all datasets are tested on Naïve Bayes and Random Forest classifiers. We extracted 49 features from 700 polymorphic computer virus samples from Netherland Net Lab and VXHeaven, which includes benign and polymorphic virus function. We spilled dataset based on 60% for training and 40% for testing. The performance metric of accuracy value, receiver operating characteristic and mean absolute error are compared between two algorithms in the experiment of static, dynamic and integrated features. Our proposed integrated features manage to achieve 98.5% of accuracy value using the highest rank feature selection.

show abstract

Android Malware Detection Based on Network Traffic Using Decision Tree Algorithm

Cited by 31 publications

References 7 publications

Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

On-Device Detection of Repackaged Android Malware via Traffic Clustering

Classification of Polymorphic Virus Based on Integrated Features

Contact Info

Product

Resources

About