AppFA: A Novel Approach to Detect Malicious Android Applications on the Network. (17th April 2018)

• Record Type: Journal Article
• Authors: He, Gaofeng; Xu, Bingfeng; Zhu, Haiting
• Other Names: Kambourakis Georgios Academic Editor.
• Is Part Of: Security and communication networks. Volume 2018(2018)
• Publication Date: 2018-04-17
• Subjects: Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1155/2018/2854728
• Languages: English
• ISSNs: 1939-0114

Abstract

Abstract : We propose AppFA, an Application Flow Analysis approach, to detect malicious Android applications (simply apps ) on the network. Unlike most of the existing work, AppFA does not need to install programs on mobile devices or modify mobile operating systems to extract detection features. Besides, it is able to handle encrypted network traffic. Specifically, we propose a constrained clustering algorithm to classify apps network traffic, and use Kernel Principal Component Analysis to build their network behavior profiles. After that, peer group analysis is explored to detect malicious apps by comparing apps' network behavior profiles with the historical data and the profiles of their selected peer groups. These steps can be repeated every several minutes to meet the requirement of online detection. We have implemented AppFA and tested it with a public dataset. The experimental results show that AppFA can cluster apps network traffic efficiently and detect malicious Android apps with high accuracy and low false positive rate. We have also tested the performance of AppFA from the computational time standpoint.