Malicious Application Traffic Detection and Identification for Mobile Android Devices

Abstract

With the popularity of Android devices, the number of malicious applications has been increasing. This paper briefly introduced malicious applications for Android devices, used a sensitivity coefficient-based feature selection method to select traffic features, detected, and identified malicious application traffic with k-means, support vector machine (SVM) and multi-layer perceptron (MLP) methods, and conducted experiments at CIC-AndMal2017. It was found that the accuracy was high when 40 features were selected. The running time of the MLP method was the shortest, 0.02 s. The accuracy of the K-means algorithm was 86.75%, showing poor performance, and the accuracy of the MLP method was 99.87%, showing the best performance. The experimental results demonstrate the effectiveness of the MLP method for monitoring and identifying malicious application traffic. The MLP method can be applied to actual mobile Android devices.