DroidCollector: A Honeyclient for Collecting and Classifying Android Applications

With the tremendous increase of Android malware, we need an automatic way of collecting Android applications and identifying the malware before they get installed on the end-user devices. In this paper, we propose a honeyclient for Android applications that will collect and classify Android applications. We first present an overview of the honeyclient. Then, we survey the different ways of infecting Android mobile devices which will shed the light on the honeyclient’s design. Finally, we describe every component of the honeyclient, namely a crawler to build a list of suspicious URLs, a client to visit the suspicious URLs, extract Android applications and analyze them, and a malware detector to classify the collected Android applications. We use a light version of the Android browser to visit the suspicious URLs enabling us to scale the visits up and an Android emulator to analyze the Android applications. As for the malware detector, we use a combination of misuse and anomaly detector allowing us to detect already known malware and new variants.