DroidDetector: a traffic-based platform to detect android malware using machine learning

Jingya Shen; Zhenxiang Chen; Shanshan Wang; Yuhui Zhu; Muhammad Umair Hassan

doi:10.1117/12.2501923

26 July 2018 DroidDetector: a traffic-based platform to detect android malware using machine learning

Jingya Shen, Zhenxiang Chen, Shanshan Wang, Yuhui Zhu, Muhammad Umair Hassan

Proceedings Volume 10828, Third International Workshop on Pattern Recognition; 108280N (2018) https://doi.org/10.1117/12.2501923
Event: Third International Workshop on Pattern Recognition, 2018, Jinan, China

Abstract

With the rapid development of the mobile Internet,more and more people are using smart phones to access the Internet, especially Android devices, which have become the most popular devices of the moment. Although today's mobile operating systems do their best to provide users with a secure Internet environment, due to the open source nature of Android, it is still unable to completely stop the outbreak of Android malware. Although existing source-based static detection and behavior-based dynamic detection can identify mobile malware, many problems still exist,such as low detection efficiency and difficulty in deployment. In order to solve these problems, we propose DroidDetector, a detection engine that can automatically detect whether an app is a malware or not by using off-line trained machine learning models for network traffic analysis. DroidDetector uses the VPNService class provided by the Android SDK to intercept network traffic (it does not require root permission). All data analysis are performed on the server,which consumes minimun cache and resource on mobile devices. We extract the length of the first 8 packets of network traffic as features and use Support Vector Machine(SVM) classification algorithm to train the model. In an evaluation experiment of 53107 TCP packet length feature tuples samples, DroidDetector can achieve 95. 68% detection confidence.

Citation Download Citation

Jingya Shen, Zhenxiang Chen, Shanshan Wang, Yuhui Zhu, and Muhammad Umair Hassan "DroidDetector: a traffic-based platform to detect android malware using machine learning", Proc. SPIE 10828, Third International Workshop on Pattern Recognition, 108280N (26 July 2018); https://doi.org/10.1117/12.2501923

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available