Android Botnets: What URLs are Telling Us

• Published in: Network and System Security Vol. 9408; pp. 78 - 91
• Main Authors: Abdul Kadir, Andi Fitriah, Stakhanova, Natalia, Ghorbani, Ali Akbar
• Format: Book Chapter
• Language: English
• Published: Switzerland Springer International Publishing AG 2015; Springer International Publishing
• Series: Lecture Notes in Computer Science
• Subjects: Android botnet; Computer security; Data encryption; Malware; Network hardware; URL; Visualization
• ISBN: 3319256440; 9783319256443
• ISSN: 0302-9743; 1611-3349
• DOI: 10.1007/978-3-319-25645-0_6

Botnets have traditionally been seen as a threat to personal computers; however, the recent shift to mobile platforms resulted in a wave of new botnets. Due to its popularity, Android mobile Operating System became the most targeted platform. In spite of rising numbers, there is a significant gap in understanding the nature of mobile botnets and their communication characteristics. In this paper, we address this gap and provide a deep analysis of Command and Control (C&C) and built-in URLs of Android botnets detected since the first appearance of the Android platform. By combining both static and dynamic analyses with visualization, we uncover the relationships between the majority of the analyzed botnet families and offer an insight into each malicious infrastructure. As a part of this study we compile and offer to the research community a dataset containing 1929 samples representing 14 Android botnet families.