A Smart Framework for Mobile Botnet Detection Using Static Analysis

Abstract

Botnets have become one of the most significant threats to Internet-connected smartphones. A botnet is a combination of infected devices communicating through a command server under the control of botmaster for malicious purposes. Nowadays, the number and variety of botnets attacks have increased drastically, especially on the Android platform. Severe network disruptions through massive coordinated attacks result in large financial and ethical losses. The increase in the number of botnet attacks brings the challenges for detection of harmful software. This study proposes a smart framework for mobile botnet detection using static analysis. This technique combines permissions, activities, broadcast receivers, background services, API and uses the machine-learning algorithm to detect mobile botnets applications. The prototype was implemented and used to validate the performance, accuracy, and scalability of the proposed framework by evaluating 3000 android applications. The obtained results show the proposed framework obtained 98.20% accuracy with a low 0.1140 false-positive rate.

1. Introduction

In the recent era, explosive growth has been seen in the sale and adoption of smartphone devices. Gartner stated in their report that the sale of smartphones is increased by 87% worldwide in the fourth quarter of 2018 [1,2]. In order to take a maximal benefit from the smartphones facilities, relevant software applications should be installed. Correspondingly, users have been downloading an increasingly large number of applications in response to advancements in smartphones [3]. The Android platform becomes the most popular with an estimated 4.839 million applications in the official Google’s Android market, having downloads in excess of 25 billion by November 2018 [4]. Meanwhile, the malicious software (malware) is on the top with the adding of 2.8 million samples to the end-users libraries [5]. The increased number of goodware applications also leads to a greater chance of installing malware to smartphones. It reflects the harmful intention of cybercriminals to create malware like adware, botnets, bugs, rootkits, spyware, Trojan horses, viruses and much more [67; 71; 75]. Among this malware, the botnets are quickly gaining the attention of researchers belonging to both academia and industry. The term “bot” is derived from the “robot” and “net” is derived from the “network” [6,7]. A bot is a type of malware that runs automatically after installation in the victim device and get the full control of that device. It is not required for the malware program to manipulate by a remote command and control servers. Therefore, the major difference between botnet and malware is the unconditional control of a remote machine through the bot codes. The botnets can be a platform for a slave, provided by Internet-connected computers. In general, botnets can be classified into traditional and mobile ones [65]. In the case of the traditional botnets, computers provide the platform for the slave bots. However, in the mobile botnet, a mobile device provides the platform for the slaves. Furthermore, the mobile botnet can be generally classified as hypertext transfer protocol (HTTP) based, Internet relay chat (IRC) based, and peer to peer (P2P) based, according to the underlying C&C (Command and Control) communication protocol [8]. Unlike the traditional cybercrime, a mobile botnet can attack and propagate itself through various methods and may cause much greater losses to smartphones [9,10].

Once a smartphone is being infected, it can be converted to bot zombie [11,12]. An infected smartphone can cause drastic threats to the end-users or the service-provider company. As far as researchers are aware, the first mobile botnet named SymbOS/Yxes appeared in 2009 [13]. The target of SymbOS/Yxes botnet was SYMBIAN OS by using a rudimentary HTTP-based C&C channel: both Trojanized game applications with bot-like capabilities that compromised mobile devices [14]. Since this study focuses on the Android OS, the terms “Android botnet” and “mobile botnet” will be used in the same meaning. In this case, the bots infect smartphones, personal digital devices (PDAs), smart watches, and tablets that have Android OS. These mobile botnets have the capability to steal sensitive information like phone numbers, International mobile equipment identity (IMEI), network operator details, international mobile subscriber identity (IMSI), voice mail numbers, location information and much more from the infected devices using the connection with command and control servers [15-19]. Phishing, SMS fraud, Spyware, Fake installation, Banking Trojans, and premium dialers are the most common threats of botnets.

A mobile botnet has four basic components, such as botmaster, command and control (C&C) server, bots, and communication channel. The one, who owns the mobile botnet, known as botmaster. C&C server is the most important component of a mobile botnet. Most of these botnets use short messaging service (SMS), hypertext transfer protocol (HTTP), and HTTP & SMS together as a command and control server [20-22]. The C&C servers are responsible for sending and receiving commands from botmaster to the infected devices known as bots. Communication channel refers to the network through which these bots are connected in order to perform illegal activities. Fig. 1 shows the basic architecture of the mobile botnet.

Fig. 1. Mobile Botnet Basic Architecture

Recently, there is a rapid growth seen in the mobile botnets to damage the performance of smartphones. At this time, NotCompatible.C is the most dangerous botnet (which belongs to AnServer bots) affected a huge amount of smartphones to access their services [23]. P2P communication architecture and various evasion approaches discriminate NotCompatible.C botnet from other mobile botnets. Similarly, TigerBot, Zeus Botnet, BMaster perform the attacks on smartphones for financial profit, identity theft, and stealing personal information [24]. The most significant feature of the Zeus botnet is the ability to perform malware activities in different operating systems. However, other mentioned botnets are built only for Android OS [25]. The Obad.a is another dangerous botnet, which uses SMS and HTTP for the distribution among the devices. In this case, the bots were infected by sending users a message with the text “MMS message has been delivered, download from www.otkroi.com” [26]. Similarly, the botmaster uses the attack vectors, such as SMS, MMS, or USB. Commonly, Bluetooth and Wi-Fi are used to spread the infected commands among the targeted devices [27]. Successful execution of an infected command on a targeted smartphone empowers a botmaster to access a victim device for the above-mentioned illegal activities. In addition, mobile botnets have extra features as compare to PC botnets, such as portability, 24/7 connectivity to the Internet, access to the most credential information, possibility of sending and receiving SMS and MMS, and dialling capabilities [28]. Therefore, botnets are expected to maintain their severe effects on mobile devices.

The rapid growth of mobile botnet applications realizes the need to develop an efficacious solution for mobile botnet detection. This study proposes a new framework for mobile botnet detection using static feature extraction and analysis. In the static analysis, the applications are decompiled, making possible exploration of the suspicious features and code [38]. To effectively identify the most significant botnet features, a huge number of benign and botware applications were surveyed and machine-learning approach was employed. The main contribution of this paper is given below.

• This paper proposed a smart framework for botnet detection in Android devices using static feature extraction and analysis.

• This study analysed a significant number of mobile botnet applications to identify the botnet C&C structure and their most relevant features.

• By using the information gain (IG) and support values approach, the most prominent features were selected and then used for classification. A selected machine-learning approach was used to classify the botnet attributes.

This paper is organized as follows: Section 2 provides an overview of related work; Section 3 describes the data collection process and the experimental study; Section 4 explains the proposed framework in more detail. Experimental results and comparison with prior work are given in Section 5. Conclusion and the reference list finalize the study.

2. Related Work

Nowadays, mobile botnet detection becomes a crucial task. Different studies proposed a number of techniques for botnet applications detection and prevention [1, 18, 29-32, 73, 79]. For easy understanding, the existing detection techniques can be classified into two main categories, such as dynamic and static analyses [33,34]. In the dynamic analysis technique, the applications are installed and run on a real device or on an emulator to observe the malicious behaviour of the malware [35]. In order to inspect the suspicious behaviour of applications sandboxes are used [36]. These are special security tools used to inspect and stop the illegal activities of malicious applications. Commercially available sandboxes provide sustainable analysis and logging facilities to observe a particular bot and to generate the report [37]. However, the generated data may not be focused on the pivotal activities of the bots. Bots can generate an overwhelming amount of information extensively calling particular functions observed by the sandbox.

On the other hand, in the static analysis technique, the applications are decompiled to find the suspicious features and lines of code [38]. This technique has been used widely due to the fast processing approach as compared to the dynamic one. Permissions and API calls are the most commonly used features in static analysis. Permissions are the gateways to interact with system resources. Each Android application requests for specific permissions, including permission to access SMS and calling modules, internal and external memory etc. AndroidManifest.XML and meta-data contain these and other important features for all Android applications available from the Google Play store [39]. In static analysis, in order to extract these features, the APK files are decompiled without executing the applications itself.

Yerima et al. [40] proposed a static analysis approach to detect Android malware by extracting the most important features, such as permissions, API calls from the AndroidManifest and Classes of Android applications. In order to extract these features, they used 1000 malicious and 1000 benign applications. The Bayesian Classifier was applied to perform the classification. The authors claimed that they achieved 92.1% accuracy by the consideration of 30 static features. However, this approach is incompetent to thoroughly scrutinize the Android applications code for suspicious behaviours. Canfora, et al. [41] claimed that the classification of malware families is not allowed in this approach.

Another mobile botnet detection approach was proposed by Peiravian and Zhu [42]. The authors utilized API calls, permission, and the combination of features. In their study, permissions were categorized into two types, such as requested and required permissions. The API_𝑗,𝑖 is represented with 1, such as API_𝑗 = 1 if the j^𝑡ℎ API call is made in the application. Similarly, the required permission is represented by 1, such as P_𝑖 = 1 . The third feature was obtained by the concatenating of these two features. In the experimental part of the study, there were 2510 samples including 1250 benign and 1260 malicious applications. The authors achieved 96.88% accuracy by selecting a high number of features. This study shows that the accuracy can be improved when the features are selected from both malware and benign applications. It also can be concluded that Bagging (an ensemble classification method) had the best performance in classifying the datasets.

De-Droid is another mobile botnet detection approach proposed by Karim et al. [43]. The authors claimed that this is a lightweight approach focusing on static analysis. This approach considers the API calls and permissions to detect suspicious binaries. In this study, 5064 malicious and 14865 benign applications were used to decode the API calls and permissions. Rashidi & Fung proposed a BotTracer, a clustering-based approach to detect bot users by the same master [44]. The key idea behind this technique is to collect the expert users’ responses to a permission request and recommend them to inexperienced users. The first step of BotTracer is the analysis of the common features of bot users resulting in the similarity graph. Then, a hierarchical clustering method employed to group the users based on the distance, defined using similarity. However, the proposed approaches are unable to detect zero-day attacks and to deeply scrutinize the applications for possible malicious behaviour.

3. Data Collection and experimental study

For the experiments, the clean (benign) and infected third-party mobile applications were used. Currently, there are various types of applications in the market, such as web tools, native applications, and widgets [18]. The web applications are those developed through HTML, JavaScript, and CSS, while the natives are developed with Android SDK. The widget applications are those which are displayed on the Android desktop. Moreover, experiments use benign applications of native nature. The samples were obtained from the Google Android market [39]. The VirusTotal Malware Intelligence Service allows the researchers to obtain samples from their databases [45]. Initially, 1865 applications were obtained and tested with the VirusTotal tool to confirm their cleanness. Finally, to avoid the duplication the Monte Carlo sampling method [66] was used giving in total 1330 benign applications, as shown in Table 1.

Table 1. Number of Benign Applications for each category

The Botnet applications, which also known as botware, are collected from the different open source repositories, such as DREBIN, ISCX Android Botnet Dataset, and Android Malware Genome Project [46-48]. The DREBIN dataset consists of 5560 applications from different 179 malware families, the ISCX dataset includes 1929 botnet samples, and the Android malware genome project consists of 1200 malware samples. To the best of our knowledge, these are the largest Android malware and botnet datasets, which include all the publicly available samples and open-source malware repositories. The same number of benign and botware applications are considered to facilitate machine-learning modelling. Table 2 shows the number of malware applications and the name of the corresponding malicious activities. Symbol ν shows that the malware family can perform this activity, while the × shows that the malware cannot perform it.

Table 2. Number of Samples for Botware Applications with Malicious Activities

4. Smart Framework for Android Botnet Detection

This section demonstrates the proposed smart framework for mobile botnet detection, which is based on the static features extraction in Android devices (Fig. 2). The proposed framework has five layers of mobile security that can detect applications having the features of mobile botnets. These five layers of detection technique are the decompiler, extractor, smart learner, features refiner, and the machine learning module respectively. Using the framework, whenever a user completes the installation of an application, a popup window appears on the screen if the installed application contains an injected code from the third party (i.e. from a cyber-criminal).

Fig. 2. A Proposed Framework for Android Botnet Detection

4.1. App Decompiler

Decompiler is responsible for the translation of the machine code into the source code. The Android applications are distributed as a machine code that is called Android package file (APKs). In order to decompile the APK files, the Android asset packaging tool (AAPT) was used (available within the Android SDK [49]). Each APK file contains the AndroidManifest.xml and the classes.DEX files that are decoded to make them humanreadable. The AndroidManifest.xml describes an Android application and encloses the essential information about the APK file, such as permissions, activities, services, and intentfilters. The same procedure was applied to decompile the classes.DEX files, which are the java source code.

4.2. Feature Extractor

This component performs reverse engineering of each decompiled application to extract static features from the AndroidManifest.xml and the classes.DEX files. Besides, tags to interact with the features inside and outside of the Android applications were extracted. For example, <uses – permission> was employed to get the permissions for accessing hardware and other components of smartphones, while <uses – activities> was used to switch between different activities inside the application. Permission tags can only interact with the smartphones when a user grants permissions to the applications during the installation or later on. However, not all requested permissions may be used by the application. E.g. <uses – features> is required to interact with other components of the application, while some of the features may not be used.

In order to extract these features from an Android application, the Androguard opensource tool was used [50]. After extraction of required features, for each Android application, a CSV file was generated for further processing. The static features, namely, permissions, activities, broadcast receivers, services, and API calls, were extracted from the AndroidManifest.XML and the classes.DEX files. In order, to automatically perform extraction of the features a Python script was applied to all Android applications. Let l and m be correspondingly the number of Android applications and the set of features including permissions, activities, broadcast receivers, services, and API calls. The features vector for the application i is (𝑋_𝑖,1, 𝑋_𝑖,2 , 𝑋_𝑖,3 , … … , 𝑋 _𝑖,𝑛) where:

\(F(i, j)=\left\{\begin{array}{ll} 1 & \text { if the application luses the feature } k \\ 0 & \text { Otherwise } \end{array}\right.\)       (1)

Similarly, suppose an instance of the class in the generated dataset is F_i ∈ {Botware, Benign}, where i shows the class of application [51]. Features of each extracted application were saved in the CSV file for further analysis (Fig. 3). The file begins with the hash function of the application and ends with the sum of all the enabled features. The hash value represents the MD5 values of the Android applications, while the values “1” and “0” correspond to enabled and disabled features, respectively. The sum of the enabled values was utilized for further analysis. In general, the analysis shows that the applications that were using more features had a higher probability to have a botware intention.

Fig. 3. Example of the CSV file of Extracted Application

Fig. 4 shows the frequencies of the permissions requests and API calls feature. The figure demonstrates that the number of the used by botware applications API calls and requested permissions is higher as compared to the benign applications. At the same time, requesting more features did not mean that the botware developers would be able to use all these features. The logic behind requesting a large number of features is that malware developers are trying to evade detection by calling these features indirectly through the code of another program. This strategy can certainly hinder the detection of malware codes.

Fig. 4. The number of requested permissions and activities of botware and benign applications

Fig. 4(a) illustrates the number of requested and used permissions by botware and benign applications. The botware features range from 18.570 % to 97.860 % while from 1.430% to 51.430% for benign applications. The average percent of requested permissions of botware is 54.249% and 11.323% for benign applications. This enormous difference shows that botware applications request a much bigger number of permissions features as compared to benign applications. For instance, one of the common features of botware and benign applications is the INTERNET permission as shown in Fig. 4(a). Here, the requests generated by botware applications was 97.86%, while 51.43% for benign applications. It shows that botware applications are usually generating more requests as compared to benign applications. Therefore, the smartphones users should be aware of the botware’s susceptible permissions requests during the installation of an Android application. The comparison of benign and botware applications with respect to API calls is given in Fig. 4(b). The obtained results show that botware applications use more API calls as compared to benign applications. At the same time, almost the same usage ratio can be seen for the services and the broadcast receivers.

4.3. Smart Learner

The smart learner takes data from the feature extractor component and generates the pattern, based on the assigned frequencies, by using the Apriori algorithm in WEKA tool [52]. The Apriori algorithm was chosen to identify the patterns of significant features combination [53]. This algorithm deals with the subset of events beyond examining the specific order of events. For easy processing, all extracted features were indexed, e.g. INTERNET with P₁ , READ_PHONE_STATE with P₂ , and so on. Similarly were indexed activities, services, broadcast receivers, and API calls.

The Apriori algorithm takes as an input the dataset B_bot that contains a full set of features of n botnet applications. Let I = {𝑃₁,𝑃₂,𝑃₃, … … , 𝑃_𝑛, 𝐴₁,𝐴₂,𝐴₃, … … , 𝐴𝑛, 𝐵₁,𝐵₂, 𝐵₃, … … , 𝐵_𝑛, 𝑆₁, 𝑆₂, 𝑆₃, … … , 𝑆_𝑛, 𝐴P₁, 𝐴P₂, 𝐴P₃, … … , 𝐴P_𝑛,} be an instance of  B_bot . The Apriori algorithm begins by pinpointing the individual repeated items in the B_bot dataset and extending them to substantial sets as much as that item sufficiently often appears. For example, A = {P₁ , A₁ , 𝐵₁ , 𝑆₁ , 𝐴P₁ } is a candidate item set. There are two values need to be known in advance for the Apriori algorithm, which are the support and the confidence levels, for the calculation of the frequency of features, used in the B_bot dataset. In this case, the support value of the candidate itemset  {P₁ , A₁ , 𝐵₁ , 𝑆₁ , 𝐴P₁ } was computed by formula (2).

\(\text { Support }(P 1, A 1, B 1, S 1, A P 1)=\frac{\text { Number of applications that contains } P 1, A 1, B 1, S 1, A P 1 \text { in } B_{\text {bot }}}{\text { Total number of Applications in } B_{\text {bot }}}\)       (2)

The candidate item set is considered as a frequent itemset or a relevant pattern, only if support  {P₁ , A₁ , 𝐵₁ , 𝑆₁ , 𝐴P₁ } >=  threshold(t), where t is a user-defined threshold. In this study, we set 0.5 as a minimum threshold [54]. The same process was applied for frequent itemset identification for benign applications. Table 3 shows the identified unique patterns for botware applications. The pattern ID represents the indexed ID of used features pattern, while the support values are calculated for each used feature pattern (UP).

Table 3. Unique Patterns for the Botware and Benign used Features

The support values in Table 3 show that the botware applications mostly utilize the combination of the features, such as the INTERNET, RECEIVE_SMS, WRITE_EXTERNAL_STORAGE, com.clientsoftware.ServiceStartr, com.phone.callcorexy.x-y.SReceiver, and SYSTEM_A-LERT_WINDOW to perform the malicious activities on the smartphone and to steal a piece of sensitive information from it. Once this mentioned malicious activity is performed, it sends the stolen information to the C&C server through the communication channel. In this malicious activity, INTERNET permission provides the connection between smartphone and C&C server, while the RECEIVE_SMS permission received the updates and commands about the activity. Botware applications having the INTERNET, WRITE_SMS and SEND_SMS permissions enable can send SMS and MMS to premium numbers with the combination of MAIN ACTIVITY and TOUCHSCREEN. It is reported that sending of SMS and MMS to the premium numbers can cause financial losses [31].

Furthermore, the location related to permissions, such as ACCESS_COARS_LOCATION and ACCESS_FINE_LOCATION is used for the smartphone data collection and network location data gathering. The pattern UP29 is the combination of INTERNET, ACCESS_NETWORK_STATE, com.google.android.mms.-LiveReceiver and com.clie-ntsoftware.SDCardServiceSt-arter is used to handle the connection between bots and botnets.

4.4. Features Refiner

This component takes input from the smart learner and use it to achieve high accuracy in a specified model of the problem domain. In the feature’s extraction process, many features are irrelevant and redundant. Such redundant features may create an issue for the learning algorithm, which includes misleading, overfitting, reducing accuracy and generality, time and space complexity [55]. It may increase the crucial effects since mobile devices have limited resources [56]. Selecting the most appropriate features to form a large feature vector space can significantly change the accuracy of the predicted model. In order to increase the efficiency and accuracy of botnet detection, it is important to implement an effective feature refining process. The basic idea of feature refining is to select the most related to botware applications features.

For this purpose, the information gain (IG) algorithm was applied to the malicious dataset [57]. It is the most common feature selection method in botware detection techniques [58]. While most of the methods followed the feature ranking approach based on specific metrics, the value was computed to score each feature individually. According to this measure, a feature Y is regarded as a better indicator than a feature Z for a class X, if  IG(𝑋|𝑌) > IG(𝑋|𝑍). Approach ranks the features by the information gained and select the high ranked features. For the computing of information gain value, WEKA is used [52]. The Android applications are inspected manually, and then the permission, activities, broadcast receivers, services, and API_Calls are noted. All these features have a specific relationship with respect to botnet activities.

4.5. Machine Learning Modelling

This component takes input data from the smart learner component. Once the features are refined, the next stage is to train the machine learning classifier. In anomaly detection, various machine-learning techniques can be used to train a model and test the datasets [60; 68; 80]. Since the dataset used in this research study is labelled and has two target classes - Benign and Botware, supervised learning technique was selected. In supervised learning, the algorithm uses a labelled dataset, which provides a possibility to evaluate the accuracy of the model on training data. This why a supervised learning technique is generally more accurate and reliable as compare to unsupervised learning. In this study, the selecting classifier is based on the performance, a number of classes and the ranking criteria of features. Since the prototype of the framework was implemented in Java, WEKA, which is a data mining software also written in Java [52,53], was used.

During the classification phase, several machine-learning algorithms were selected to recognize botware applications based on classification accuracy. Choosing an appropriate classifier ultimately demonstrates the accuracy of the detection framework. To choose a proper machine-learning algorithm for classification, the following requirements were considered: (1) diversity (the number of static features were taken from the multiple domains); (2) sparse feature set (the supreme features set were finally selected for the framework evaluation); (3) scalability (the system should be able to deal with future requirements of users); and (4) performance (algorithms for testing and training should provide a prompt response to a user). Given these considerations, support vector machine (SVM), Random Forest, J-48, simple logistic regression (SLR), and Naïve Bayes were selected as the classification algorithms to establish and test the proposed framework.

5. Experimental Results

This section discusses the obtained results for individual and combined features.

5.1. Performance Evaluation Parameters

This section describes the evaluating process of the proposed botnet detection framework. The performance has been evaluated using five matrices, namely True Positive Rate (TPR), False Positive Rate (FPR), Precision, F-measure, and Accuracy, and next compared to the existing state-of-the-art detection techniques. Literature review shows that these parameters are commonly used for the evaluation of the malware detection frameworks and tools. Table 4 shows the evaluation parameters with the description and the corresponding formulas.

Table 4. Performance Evaluation Parameters of the Proposed Framework

5.2. Results

First, the experiments were conducted separately on the permissions, the activities, the broadcast receivers, the services, and the API_calls features. These features were next united to conduct experiments on the combined features set. The obtained results are summarized in Table 5. In general, random forest obtained higher accuracy rate for all selected features as compared to other classifiers (except the services feature). Considering only the accuracy of evaluation, the random forest was found the best classifier. TPR, FPR, precision, and Fmeasure were used to evaluate the proposed framework and to obtain more accurate results. The experiments were performed on all selected classifiers by considering the mentioned parameters.

Table 5. Results, obtained by considering separate features

Once researchers obtained the results for all selected features by considering different classifiers, they combined the features to perform further experiments. Table 6 summarizes the obtained results. Random forest achieved the highest accuracy 98.2%, while TPR is 0.7880, precision is 0.8893 and FPR is 0.1140. However, experiments produce a low F-measure of 0.7457. Table 6 shows that the random forest achieved more accurate results by considering the combined features.

Table 6. Results, obtained by considering combined features

5.3. Comparison with prior work

The need for new botnet detection techniques is a crucial security requirement of Android devices. The proposed framework is an effective and efficient botnet detection approach for Android devices. The proposed framework has high accuracy with the obtained value of 98.20%, compared to Rashidi & Fung (2016), obtained 89.30% by utilizing the permissions feature. Sanz et al. (2013), obtained 94.83% accuracy by using the permissions and API_Calls features as shown in Table 7. The accuracy obtained by Yerima et al., (2014) was 92.10 % and Peiravian & Zhu (2013) showed the accuracy score of 96%. Overall, the proposed framework is more accurate when compared with Rashidi & Fung, (2016), Sanz et al., (2013), Yerima et al., (2014) and Peiravian & Zhu, (2013). The main reason for the better results of the proposed framework is adding the refining component and use of the features selection approach. With using of refining component, the proposed framework ignored the features, which are not vulnerable to Android botnets attacks.

Table 7. Comparison with Existing Techniques

Fig. 5 shows the accuracy represented by a bar graph. It depicted that the proposed framework has high accuracy as compared to other considered studies.

Fig. 5. Comparison of accuracy of the proposed framework with existing solutions

The study [18] proposed to discover malicious applications by using the difference in the Android application permissions that the application request upon installation. Android permissions are coarse-grained [60]. For example, the INTERNET permission does not have the capability to restrict access to a particular Uniform Resource Locator (URL). READ_PHONE_STATE allows an app to identify whether the device rings or is on hold. At the same time, it also allows the app to read sensitive information, such as device identifiers. Permissions, as WRITE_SETTINGS, CAMERA are broadly defined, violating the least privilege access principle. Access to WRITE_CONTACTS or WRITE_SMS does not imply access to READ_CONTACTS or READ_SMS permissions [49]. Thus, permissions are not hierarchical, and a developer must separately request them. In addition, at the installation time, a user is forced to either grant all permissions or deny the application installation. Hence, the dangerous permissions cannot be avoided at the installation time. Moreover, the users cannot differentiate between the necessity and its misuse, which may expose exploitation.

In approach [61], authors extracted static features from the androidmanifest.xml file of 666 Android applications. They used machine-learning techniques, such as K-Nearest Neighbors (K-NN), Decision Trees, Bayesian networks, Support Vector Machines (SVM) to detect malicious applications. K-NN was used due to its simplicity in classifying instances into different classes; at the same time, a decision tree allowed an easy implementation. The Bayesian network was employed for determining the probability of a hypothesis certainty. On the long run, SVM was used to solve the problem of kernel functions, which may lead the technique to the non-linear classification surface [62].

The study [42] developed a machine-learning framework to analyze benign and malicious applications by using the permissions and API calls as the features. In their study, authors examined in total 2400 Android malware and benign applications to extract the requested permissions and API calls. Authors achieved 96.88% of accuracy by selecting a high number of features. This approach shows that the accuracy can be improved when the number of features is selected from both malware and benign applications. Extracting and selecting a bigger number of features allow to improve the accuracy, while the memory and time use are increased [60]. This framework was specifically focused on malware applications. However, using these approaches mobile botnets cannot be detected in Android devices. This study has almost the same nature as an aforementioned study on MAMA [18], which use the same features. Researchers achieved 94.83% accuracy when 130 features were examined.

Yerima et al. (2014) developed a proactive machine-learning approach based on Bayesian classification and aimed to detect zero-day Android malware attacks using static analysis approach [59]. This approach has three main components, which are decompression, identification, and classification. First, an application is decompiled by reverse engineering by using Dalvik VM to extract features from the AndroidManifest.xml and .DEX classes [63]. All extracted features are stored in a file with the .csv extension for further analysis. In the identification step, this component converts the extracted features file to a readable form for further analysis. In the classification process, the Bayesian algorithm classifies the malware and benign applications as a result [52]. This approach was based on the large existing set of malware of 49 families. Specifically, this technique achieved approximately 92.1% accuracy by using a set of 30 static features.

Karim et al. (2015) research work focused on Android malware identification only. By using their approach, a mobile botnet cannot be detected. Authors used a few numbers of features as compared to the study [42], which significantly affects the accuracy of malware detection. According to the study [64], the time is taken for features extraction and computation is decreased to 77%. However, another study showed that by using these features the time taken for features extraction is increased at 28% [64]. Thus accuracy and time consumption are the main issues need to be addressed.

BotTracer [44] is a clustering-based method to detect bot users controlled by the same masters. The main method of the proposed method is to plot the Android users in various groups based on their similarity. It is an Android permissions recommendation framework, which allows users to grant application permissions requests in a fine-grained manner. In Android applications, permissions are the main factor during installation that cannot be ignored. For example, the INTERNET permission does not have the capability to restrict access to a particular Uniform Resource Locator (URL), READ_PHONE_STATE allows an app to identify whether the device rings or is on hold [65].

The key idea behind BotTracer technique [44] is to collect the expert users’ responses to a permission request and recommend them to inexperienced users. BotTracer uses two phases with the first analysis of the common features of the bot users for the construction of a similarity graph. Then, a hierarchical clustering method groups those users based on the distance, which is defined using similarity. This approach has many limitations in terms of botnet detection. First, it detects the simulated bot from user profiles only. Secondly, it considers the DEX bytecode, while it ignores the native code and app resources. Thirdly, the opcode sequence does not include high-level semantic information and hence generates false negatives. With these limitations, the smart adversary can easily bypass this technique using code transformation, such as inserting junk bytecode, restructure methods, and alter control flow to evade the BotTracer prototype.

6. Conclusion and Future Work

Botnets have become one of the most significant threats to Internet-connected smartphones. An increasing number of botnet attacks brings challenges for the detection of harmful software. To contribute to this domain, this study proposes a new botnet detection framework using static feature extraction and machine learning algorithms. In order to identify the C&C structure and the most relevant features, a considerable number of botnet applications were analyzed. The static features, such as permissions, activities, broadcast receivers, services, and API calls were extracted and further analysed. The extraction of the features, the used patterns and the feature refining component differentiate the proposed technique from others. By using the information gain and the Apriori algorithms, the most prominent features were identified that gives the possibility to classify an Android application as a mobile botnet and to prevent an attack. The selected features were used in the machine-learning algorithm for classification, which achieved 98.2% accuracy with very low FPR (0.1140). Among the different class ifiers used, the random forest gave the best results. The obtained results show that the proposed framework accurately identifies botnet applications. The limitation of the proposed approach is that it is based on static features; the accuracy of prediction can be improved by expanding the functionality by dynamic properties. It will be a direction of our future work.