Mobile Botnet Classification by using Hybrid Analysis

Abstract

The popularity and adoption of Android smartphones has attracted malware authors to spread the malware to smartphone users. The malware on smartphone comes in various forms such as Trojans, viruses, worms and mobile botnet. However, mobile botnet or Android botnet are more dangerous since they pose serious threats by stealing user credential information, distributing spam and sending distributed denial of service (DDoS) attacks. Mobile botnet is defined as a collection of compromised mobile smartphones and controlled by a botmaster through a command and control (C&C) channel to serve a malicious purpose. Current research is still lacking in terms of their low detection rate due to their selected features. It is expected that a hybrid analysis could improve the detection rate. Therefore, machine learning methods and hybrid analysis which combines static and dynamic analyses were used to analyse and classify system calls, permission and API calls. The objective of this paper is to leverage machine learning techniques to classify the Android applications (apps) as botnet or benign. The experiment used malware dataset from the Drebin for the training and mobile applications from Google Play Store for testing. The results showed that Random Forest Algorithm achieved the highest accuracy rate of 97.9%. In future, more significant approach by using different feature selection such as intent, string and system component will be further explored for a better detection and accuracy rate.

A Novel Android Botnet Detection System Using Image-Based and Manifest File Features

“…Using both permission and API call features, Random Forest obtained the best results with 99.4% TP rate, 16.1% FP rate, 93.2% precision and 99.4% recall. This work was extended in [36] to include system calls and this resulted in improved performance with Random Forest achieving 99.4% TP rate, 12.5% FP rate, 98.2% precision, 99.4% recall and 97.9% accuracy.…”

A deep learning-enhanced botnet detection system based on Android manifest text mining

“…Random Forest obtained the best results. The work was extended in [13] by including system calls in the feature set. The best results obtained were 99.4% TPR, 12.5% FPR, and 97.9% overall accuracy.…”

“…understanding permission protection levels). Moreover, our proposed system requires less feature extraction effort compared to the more manual systems presented in [12], [13], [17], [18], [19] and [26] for example. In section III, we describe the proposed system in greater detail.…”

Android Botnet Detection Using Risk Assessment

“…Features from permission and API calls which having related with GPS exploitation and the impact to the privacy, financial and system categories were selected during the analysis. Yusof et al listed out the top 20 permission and API calls features that were related with Android botnet and GPS exploitation Yusof, Saudi, et al, 2017b). As a result, from the comprehensive review and analysis, this research selected 12 features for permissions and 30 features for API calls.…”

“…Normally, these third-party or unofficial markets provide free, non-paying apps or cheaper apps as compared to Google Play Store. This attracts more users to use the third-party market and thus, it can possibly expose the smartphone users to download and install malicious apps from this market (Yusof, Saudi, & Ridzuan, 2017b). The risk assessment method is needed before the installation for the existing apps or while downloading the apps from third-party markets, to evaluate the reliability of the apps.…”