On-Device Detection of Repackaged Android Malware via Traffic Clustering

Figure 5

Available frameworks for android malware detection. Various approaches, such as [10], send the extracted features to a remote server other than to the cloud. We still regard them as following the cloud-based framework because there is no essential difference for malware detection. As illustrated in (b), the detection results are typically presented to the network administrator and are not fed back to the mobile devices. (a) Framework based on cloud. (b) Framework based on network.

(a)

(b)