DroidCollector: A High Performance Framework for High Quality Android Traffic Collection

In this mobile era, people have become increasingly dependent on smart devices. Smartphones have emerged as the most popular smart computing device. However, numerous security issues affecting smartphones have been exposed. In recent years, mobile network traffic based approaches have been proposed to identify malware malicious behaviors, but these approaches, especially the approaches using machine learning methods are largely constrained by the difficulty of mobile traffic dataset collection. Without sufficient and effective mobile traffic dataset, research focusing on mobile network traffic will be hindered. This study introduces DroidCollector, a high performance framework for high quality Android traffic collection. This framework leverages multithreading to perform active and automatic network traffic collection. Using this framework, we collect 808 MB and 330 MB traffic data generated by 6000 benign apps and 5560 malicious apps in a short period of time, respectively. The collected high quality traffic is mostly generated from apps and with little irrelevant traffic. We also apply machine learning algorithm on the extracted traffic features to identify malicious network behaviors. The experimental result shows that it can achieve a malicious traffic detection rate of 98% on average.