Authors: Victor G. Turrisi Da Costa; Sylvio Barbon
Addresses: Computer Science Department, Londrina State University, Londrina, PR, Brazil ' Computer Science Department, Londrina State University, Londrina, PR, Brazil ' School of Computer Science, Federal University of Uberlândia, Uberlândia, MG, Brazil ' National Institute of Telecommunications (Inatel), Santa Rita do Sapucaí, MG, Brazil; Instituto de Telecomunicações, Lisboa, Portugal ' Computer Science Department, Londrina State University, Londrina, PR, Brazil
Abstract: Mobile botnets are a growing threat to the internet security field. These botnets target less secure devices with lower computational power, while sometimes taking advantage of features specific to them, e.g., SMS messages. We propose a host-based approach using machine learning techniques to detect mobile botnets with features derived from system calls. Patterns created tend to be shared among applications with similar actions. Therefore, different botnets are likely to share similar system call patterns. To measure the effectiveness of our approach, a dataset containing multiple botnets and legitimate applications was created. We carried out three experiments, namely finding out the best time-window, and performing feature selection and hyperparameter tuning. A high performance (over 84%) was achieved in multiple metrics across multiple machine learning algorithms. An in-depth analysis of the features is also presented to help future work with a solid discussion about system call-based features.
Keywords: mobile botnet detection; feature selection; host-based approach.
International Journal of Security and Networks, 2019 Vol.14 No.2, pp.103 - 118
Available online: 03 Jun 2019 *Full-text access for editors Access for subscribers Purchase this article Comment on this article