Visible to the public DroidClassifier: Efficient Adaptive Mining of Application-Layer Header for Classifying Android MalwareConflict Detection Enabled

TitleDroidClassifier: Efficient Adaptive Mining of Application-Layer Header for Classifying Android Malware
Publication TypeConference Proceedings
Year of Publication2016
AuthorsZhiqiang Li, Lichao Sun, Qiben Yan, Witawas Srisa-an, Zhenxiang Chen
Conference Name12th EAI International Conference on Security and Privacy in Communication Networks
Date Published10/2016
Conference LocationGUANGZHOU, PEOPLE'S REPUBLIC OF CHINA
KeywordsAndroid Malware Detection, CMU, HTTP Network Traffic, Jan'17, Malware Clas- sification, mobile security
Abstract

A recent report has shown that there are more than 5,000 malicious applications created for Android devices each day. This creates a need for researchers to develop effective and efficient malware classification and detection approaches. To address this need, we introduce DroidClassifier: a systematic framework for classifying network traffic generated by mobile malware. Our approach utilizes network traffic analysis to construct multiple models in an automated fashion using a supervised method over a set of labeled malware network traffic (the training dataset). Each model is built by extracting common identifiers from multiple HTTP header fields. Adaptive thresholds are designed to capture the disparate characteristics of different malware families. Clustering is then used to improve the classification efficiency. Finally, we aggregate the multiple models to construct a holistic model to conduct cluster-level malware classification. We then perform a comprehensive evaluation of DroidClassifier by using 706 malware samples as the training set and 657 malware samples and 5,215 benign apps as the testing set. Collectively , these malicious and benign apps generate 17,949 network flows. The results show that DroidClassifier successfully identifies over 90% of different families of malware with more than 90% accuracy with accessible computational cost. Thus, DroidClassifier can facilitate network management in a large network, and enable unobtrusive detection of mobile malware. By focusing on analyzing network behaviors, we expect DroidClassifier to work with reasonable accuracy for other mobile platforms such as iOS and Windows Mobile as well.

Citation Keynode-30363

Other available formats:

Li_DroidClassifier_JA.pdf
AttachmentTaxonomyKindSize
Li_DroidClassifier_JA.pdfPDF document546.46 KBDownloadPreview