AppFA: A Novel Approach to Detect Malicious Android Applications on the Network

摘要: We propose AppFA, an Application Flow Analysis approach, to detect malicious Android applications (simply apps) on the network. Unlike most of existing work, AppFA does not need install programs mobile devices or modify operating systems extract detection features. Besides, it is able handle encrypted network traffic. Specifically, we a constrained clustering algorithm classify apps traffic, and use Kernel Principal Component build their behavior profiles. After that, peer group analysis explored by comparing apps’ profiles with historical data selected groups. These steps can be repeated every several minutes meet requirement online detection. have implemented tested public dataset. The experimental results show that cluster traffic efficiently high accuracy low false positive rate. also performance from computational time standpoint.