DroidClassifier: Efficient Adaptive Mining of Application-Layer Header for Classifying Android Malware

摘要: A recent report has shown that there are more than 5,000 malicious applications created for Android devices each day. This creates a need researchers to develop effective and efficient malware classification detection approaches. To address this need, we introduce DroidClassifier: systematic framework classifying network traffic generated by mobile malware. Our approach utilizes analysis construct multiple models in an automated fashion using supervised method over set of labeled (the training dataset). Each model is built extracting common identifiers from HTTP header fields. Adaptive thresholds designed capture the disparate characteristics different families. Clustering then used improve efficiency. Finally, aggregate holistic conduct cluster-level classification. We perform comprehensive evaluation DroidClassifier 706 samples as 657 5,215 benign apps testing set. Collectively, these generate 17,949 flows. The results show successfully identifies 90% families with accuracy accessible computational cost. Thus, can facilitate management large network, enable unobtrusive By focusing on analyzing behaviors, expect work reasonable other platforms such iOS Windows Mobile well.