AppFA: A Novel Approach to Detect Malicious Android Applications on the Network

作者：He, Gaofeng; Xu, Bingfeng^*; Zhu, Haiting

来源：Security and Communication Networks, 2018, 2018: UNSP 2854728.

DOI：10.1155/2018/2854728

• MOBILE MALWARE
• ATTACK

We proposeAppFA, anApplication FlowAnalysis approach, to detectmaliciousAndroid applications (simply apps) on the network. Unlike most of the existing work, AppFA does not need to install programs on mobile devices or modify mobile operating systems to extract detection features. Besides, it is able to handle encrypted network traffic. Specifically, we propose a constrained clustering algorithm to classify apps network traffic, and use Kernel Principal Component Analysis to build their network behavior profiles. After that, peer group analysis is explored to detectmalicious apps by comparing apps' network behavior profiles with the historical data and the profiles of their selected peer groups. These steps can be repeated every several minutes to meet the requirement of online detection. We have implemented AppFA and tested it with a public dataset. The experimental results show that AppFA can cluster apps network traffic efficiently and detect malicious Android apps with high accuracy and low false positive rate. We have also tested the performance of AppFA from the computational time standpoint.

• 出版日期2018
• 单位南京林业大学; 南京邮电大学