On-Device Detection of Repackaged Android Malware via Traffic Clustering

Figure 14

Example of app clustering. Obviously, two clusters are identified. The dot in the top left corner is an outlier. The outlier is detected as an abnormal but harmless app by our method. This figure was generated by the density peak clustering tool.