On-Device Detection of Repackaged Android Malware via Traffic Clustering

Figure 16

Clustering results of various malware that were repackaged from air.com.aceviral.motox3. The outlier in the middle is detected as an abnormal but harmless app. This figure was generated by the density peak clustering tool.