Scalable Traffic Dependence Analysis for Detecting Android Malware Activities∗

The openness of Android application development mech-anism poses security challenges to smartphone users. Mali-cious apps (malware) may be created by repackaging popular apps. At runtime, they directly fetch and run code on-the-fly without the user’s knowledge [6]. Thereafter, malicious apps may spy on the victim users, stealthily collect and exfil-trate user’s information. Therefore, they threaten the data confidentiality and system integrity on Android devices. Existing static analysis solutions inspect the source code, binaries or call sequences for anomalies. For example, SCS-Droid [7] identifies the malicious apps by extracting the sub-sequences of system calls. However, dynamic code loading, Java reflection-based method invocation, data encryption, and self-verification of signatures are commonly seen in the malware code [4]. These types of code obfuscation make static analysis based detection challenging. Dynamic anal-ysis, as a complementary to the static analysis, detects the runtime behaviors of the malicious apps (e.g., verifying the sensitive information flows through the apps [3]). In this work, we aim at identifying malicious apps by ana-lyzing their dynamic behaviors, specifically the network traf-fic. Our goal is to profile the normalcy of the mobile traffic patterns of benign apps, and thus to detect the malicious network requests that are sent without user’s awareness. We propose a triggering relation model to formalize the causal relations of app-generated network requests in An-droid. The problem of dependency discovery on network data was first introduced in [12]. The dependency of net-work requests is defined as the triggering relationship (TR). The triggering relation of two network requests ri and rj exists if rj cannot be issued unless ri is sent out first. This temporal and causal relationship can be represented in a di