A First Look at Android Malware Traffic in First Few Minutes

摘要: With the advent of mobile era, terminals are going through a trend surpassing PC to become most popular computing device. Meanwhile, hackers and viruswriters paying close attention terminals, especially Android platform. The growing malwares on system has drawn attentions from both academia security industry. Recently, network traffic analysis been used identify malware. But due lack large-scale malware repository systematic features, existing research mostly remain in theory. In this paper, we design an behavior monitoring scheme capture data generated by samples real Internet environment. We 5560 first 5 minutes, analyze major compositions data. discover that HTTP DNS accounted for more than 99% application layer traffic. then present related features: query, packet length, ratio downlink uplink amount, request Ad feature. Our statistical results illustrate that: (1) 70% generate malicious (2) query can be malware, detection rate reaches 69.55% 40.89% respectively, (3) greatly affect detection. believe our provides in-depth into malwares' behaviors.