Article: Mobile botnets detection based on machine learning over system calls Journal: International Journal of Security and Networks (IJSN) 2019 Vol.14 No.2 pp.103 - 118 Abstract: Mobile botnets are a growing threat to the internet security field. These botnets target less secure devices with lower computational power, while sometimes taking advantage of features specific to them, e.g., SMS messages. We propose a host-based approach using machine learning techniques to detect mobile botnets with features derived from system calls. Patterns created tend to be shared among applications with similar actions. Therefore, different botnets are likely to share similar system call patterns. To measure the effectiveness of our approach, a dataset containing multiple botnets and legitimate applications was created. We carried out three experiments, namely finding out the best time-window, and performing feature selection and hyperparameter tuning. A high performance (over 84%) was achieved in multiple metrics across multiple machine learning algorithms. An in-depth analysis of the features is also presented to help future work with a solid discussion about system call-based features. Inderscience Publishers - linking academia, business and industry through research

Title: Mobile botnets detection based on machine learning over system calls

Authors: Victor G. Turrisi Da Costa; Sylvio Barbon Junior; Rodrigo S. Miani; Joel J.P.C. Rodrigues; Bruno Bogaz Zarpelão

Addresses: Computer Science Department, Londrina State University, Londrina, PR, Brazil ' Computer Science Department, Londrina State University, Londrina, PR, Brazil ' School of Computer Science, Federal University of Uberlândia, Uberlândia, MG, Brazil ' National Institute of Telecommunications (Inatel), Santa Rita do Sapucaí, MG, Brazil; Instituto de Telecomunicações, Lisboa, Portugal ' Computer Science Department, Londrina State University, Londrina, PR, Brazil

Abstract: Mobile botnets are a growing threat to the internet security field. These botnets target less secure devices with lower computational power, while sometimes taking advantage of features specific to them, e.g., SMS messages. We propose a host-based approach using machine learning techniques to detect mobile botnets with features derived from system calls. Patterns created tend to be shared among applications with similar actions. Therefore, different botnets are likely to share similar system call patterns. To measure the effectiveness of our approach, a dataset containing multiple botnets and legitimate applications was created. We carried out three experiments, namely finding out the best time-window, and performing feature selection and hyperparameter tuning. A high performance (over 84%) was achieved in multiple metrics across multiple machine learning algorithms. An in-depth analysis of the features is also presented to help future work with a solid discussion about system call-based features.

Keywords: mobile botnet detection; feature selection; host-based approach.

DOI: 10.1504/IJSN.2019.100092

International Journal of Security and Networks, 2019 Vol.14 No.2, pp.103 - 118

Received: 03 May 2018
Accepted: 20 Jan 2019
Published online: 07 Jun 2019 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article

Title: Mobile botnets detection based on machine learning over system calls

Keep up-to-date