A Novel Android Botnet Detection System Using Image-Based and Manifest File Features

Suleiman Y Yerima,Abul Bashar

doi:10.3390/electronics11030486

Suleiman Y Yerima, Abul Bashar

Open Access

https://doi.org/10.3390/electronics11030486

Copy DOI

Abstract

Malicious botnet applications have become a serious threat and are increasingly incorporating sophisticated detection avoidance techniques. Hence, there is a need for more effective mitigation approaches to combat the rise of Android botnets. Although the use of Machine Learning to detect botnets has been a focus of recent research efforts, several challenges remain. To overcome the limitations of using hand-crafted features for Machine-Learning-based detection, in this paper, we propose a novel mobile botnet detection system based on features extracted from images and a manifest file. The scheme employs a Histogram of Oriented Gradients and byte histograms obtained from images representing the app executable and combines these with features derived from the manifest files. Feature selection is then applied to utilize the best features for classification with Machine-Learning algorithms. The proposed system was evaluated using the ISCX botnet dataset, and the experimental results demonstrate its effectiveness with F1 scores ranging from 0.923 to 0.96 using popular Machine-Learning algorithms. Furthermore, with the Extra Trees model, up to 97.5% overall accuracy was obtained using an 80:20 train–test split, and 96% overall accuracy was obtained using 10-fold cross validation.

Highlights

The prevalence of mobile malware globally is a well-known phenomenon as increasing malware of different types continue to target mobile platforms and Android.The McAfee Threat report of June 2021 stated that around 7.73 million new mobile malware samples were seen in 2020 alone [1]
We demonstrate the feasibility of our approach using a dataset of Android botnets and benign samples
The experiments performed on the DREBIN dataset achieved 92.59% accuracy using Android certificates and manifest malware images

Summary

Introduction

The McAfee Threat report of June 2021 stated that around 7.73 million new mobile malware samples were seen in 2020 alone [1]. The report further revealed that 2.34 million new mobile malwares had already been discovered in the wild during the first quarter of 2021. Android, being an open source mobile and IoT platform that permits users to install apps from diverse sources is the prime target for mobile malware. Even though the Google play store benefits from screening services to prevent the distribution of malicious apps, cleverly crafted malware, such as the Chamois botnet [2,3,4], were still able to bypass protection mechanisms and infect millions of users worldwide

Methods

Results

Conclusion