Network Flow-Based Dynamic Detection System for Android Adware Using Pre-Trained Models

In recent years, the use of Android devices has become widely prevalent, accompanied by a vast availability of Android applications for download and use. Concurrently, a significant amount of advertising software exists within Android applications, which can cause considerable inconvenience and trouble to users while posing a potential threat to user privacy. Due to the sheer quantity and complexity of advertising software, the current dynamic detection systems for such software suffer from inadequate accuracy. To improve the detection accuracy, we propose NF-BERT, a dynamic Android adware detection system based on network flow using a pre-trained model. Additionally, we have designed a data preprocessing method that redefines missing values based on statistical data to accommodate different scenarios. The system captures the network flow generated by software, applies data preprocessing techniques, and converts it into a language-like format for prediction. As a result, it achieves dynamic detection of Android advertising software. The proposed system demonstrates high accuracy, speed, and good generalization ability. On datasets CIC-AndMaI2017 and CIC-InvesAndMaI2019, our results outperform state-of-the-art dynamic detection methods, achieving an accuracy improvement to 97.05^% and an F1 score improvement to 98.30%.