PICAndro: Packet InspeCtion-Based Android Malware Detection

Vikas Sihag,Pradeep Singh,Manu Vardhan,Jung Taek Seo,Gaurav Choudhary,Zhe-Li Liu

doi:10.1155/2021/9099476

Abstract

The post-COVID epidemic world has increased dependence on online businesses for day-to-day life transactions over the Internet, especially using the smartphone or handheld devices. This increased dependence has led to new attack surfaces which need to be evaluated by security researchers. The large market share of Android attracts malware authors to launch more sophisticated malware (12000 per day). The need to detect them is becoming crucial. Therefore, in this paper, we propose PICAndro that can enhance the accuracy and the depth of malware detection and categorization using packet inspection of captured network traffic. The identified network interactions are represented as images, which are fed in the CNN engine. It shows improved performance with the accuracy of 99.12% and 98.91% for malware detection and malware class detection, respectively, with high precision.

Highlights

Cell phones have become a vital piece of our routine for accessing valuable services as mobile banking, shopping, food, and governance. e data transferred from these apps are sensitive, and many malicious applications are objectified to get such information using different means [1]
We propose PICAndro (Packet InspeCtionbased Android malware detection) a network interaction-based detection framework
Captured network interactions in the form of packets are inspected to extract network flows and sessions, which are further represented in the form of images. e generated images are fed into convolution neural networks for training the model, which is evaluated against the test dataset to answer our research questions. e proposed approach consists of below mentioned modules

Summary

Introduction

Cell phones have become a vital piece of our routine for accessing valuable services as mobile banking, shopping, food, and governance. e data transferred from these apps are sensitive, and many malicious applications are objectified to get such information using different means [1]. A popular and attractive name, “Coronavirus,” has been used in different ways for malicious purposes, such as package names concealing spyware and banking Trojans, adwares, and droppers [2]. This was not limited to naming: the pandemic theme was used in application user interfaces. Mobile malware and adware in particular often come in the form of a gaming or entertainment app that seems harmless, but what users are unaware of is that their device is doing malicious activities in the background [3].

Methods

Findings

Discussion

Conclusion