On-Device Detection of Repackaged Android Malware via Traffic Clustering

Abstract

Malware has become a significant problem on the Android platform. To defend against Android malware, researchers have proposed several on-device detection methods. Typically, these on-device detection methods are composed of two steps: (i) extracting the apps’ behavior features from the mobile devices and (ii) sending the extracted features to remote servers (such as a cloud platform) for analysis. By monitoring the behaviors of the apps that are running on mobile devices, available methods can detect suspicious applications (simply, apps) accurately. However, mobile devices are typically resource limited. The feature extraction and massive data transmission might consume substantial power and CPU resources; thus, the performance of mobile devices will be degraded. To address this issue, we propose a novel method for detecting Android malware by clustering apps’ traffic at the edge computing nodes. First, a new integrated architecture of the cloud, edge, and mobile devices for Android malware detection is presented. Then, for repackaged Android malware, the network traffic content and statistics are extracted at the edge as detection features. Finally, in the cloud, similarities between apps are calculated, and the similarity values are automatically clustered to separate the original apps and the malware. The experimental results demonstrate that the proposed method can detect repackaged Android malware with high precision and with a minimal impact on the performance of mobile devices.

Explainable Malware Detection System Using Transformers-Based Transfer Learning and Multi-Model Visual Representation

“…These solutions are based solely on consumer data over cloud servers, ensuring access to mobile apps. The network communication traces enable the tracking and detection of various malware types [22]. Figure 2 describes the explainable malware detection system using transfer learning and texture features analysis.…”

FB2Droid: A Novel Malware Family-Based Bagging Algorithm for Android Malware Detection

“…Different from static analysis, dynamic analysis monitors the operation of the program in real time to find and detect malicious behavior of the program. Among them, the dynamic feature includes network traffic [22,23], system calls [24][25][26], and resource consumption [27]. Vinod et al [25] proposed the Android malware detection scheme based on system calls, and the results are verified on five datasets.…”