On-Device Detection of Repackaged Android Malware via Traffic Clustering

<div>Illustration of the feature set. The set contains the client IP address, app name, and app version. Each network flow that is generated by App <i>i</i> in a device is represented by the features extracted from the flow and by the server IP address and port.</div>

Security and Communication Networks

fig8

Figure 8

Figure 8: On-Device Detection of Repackaged Android Malware via Traffic Clustering 