Detecção de android botnet baseada na relevância de permissões e filtros de intenção

Abstract

A large number of Android devices and the availability of sensitive data have made smartphones a new environment for spreading malicious activities. As smartphones remain online for long periods, they provide an ideal platform for operating botnets, also known as Android botnets. For this reason, recent research has focused on solutions for Android botnet detection based on information from applications. However, the lack of understanding of the behavior and specifics of malware in botnets for mobile devices makes it difficult to design solutions to mitigate this problem. To make botnet detection systems more efficient, discriminating the characteristics that describe benign and malicious applications is a critical and fundamental issue for developing countermeasures. In this context, this work describes an Android botnet detection method based on data extracted from Android applications using information retrieval quantifiers to define the most relevant characteristics and, as a result, provide greater efficiency of Android botnet detection through machine learning algorithms. The proposed method reduces the feature space dimensionality using a weighting measure based on the TF-IDF (Term Frequency-Inverse Document Frequency) to identify the most relevant features in samples through requested permissions and the actions performed by the application components. Experiments performed with 2,997 real world samples of applications (benign and malicious) show that the proposed method improves, in all evaluated scenarios, the effectiveness of learning models in the classification process of Android botnets.