AppFA: A Novel Approach to Detect Malicious Android Applications on the Network

Algorithm 1

App traffic clustering procedure.

(1) let denotes signature set and stands for the signature

seeds

(2) while the clustering signal is received do

(3) if is empty then

(4)

(5) end if

(6) carry out signature matching

(7) carry out constrained flow clustering

(8) update with the clustering results

(9) end while