Finding Android Malware Trace from Highly Imbalanced Network Traffic

Abstract

With the yearly increase of the amount of Android users, malicious applications for mobile terminals are emerging in endlessly. Many researchers have started to explore how malicious apps are detected from the perspective of network traffic. We design and implement a control and management system of Android traffic collection, which contains the functions of downloading APKs, malware static detection, network traffic collection and resources management. It can collect network traffic efficiently and manage the dataset easily. Furthermore, we address the machine learning based malware detection which using network traffic is an imbalanced learning problem. In addition, four imbalanced algorithms are applied to Android malware detection using the highly imbalanced network traffic dataset. The result of the experiments show that the combination of SMOTE and SVM are the best performer in the all combinations.