Mining network traffic for application category recognition on Android platform

摘要: Signature-based static mobile malware detection is fragile when facing code obfuscation and transformation attacks. Behavior based mechanisms have been widely studied experimented. So far only the application's running behaviors, such as API calls resource consumption are used, which can also be easily concealed obfuscated with various coding tricks. Most need either cellular or network connection to conduct their malicious activities. We propose monitor an behavior interaction characterize application behaviors. An integrated testbed system has designed prototyped for collection. Statistical features derived from traffic, further fed a machine-learning classifier build one general model each typical category of applications. Experiments show that applications in identical functionality exhibit similar makes it possible use behaviors evaluate future unknown its trustworthiness.