CREDROID is a semi-automated approach which works on various factors like the remote server where the application is connecting, data being sent and the protocol being used for communication for identifying the trustworthiness (credibility) of the application. Pattern in our work refers to the leakage of sensitive information being sent to the remote server. Instead of performing signature based detection which is unable to detect polymorphic malwares, we propose a pattern based detection. In this paper we have proposed a method named as CREDROID which identifies malicious applications on the basis of their Domain Name Server(DNS) queries as well as the data it transmits to remote server by performing the in-depth analysis of network traffic logs in offline mode. For our work, we have confined ourselves to defining maliciousness as leakage of privacy information by Android application. A common feature of the malware is to access the sensitive information from the mobile device and transfer it to remote servers. The malwares get installed in mobile phones through various popular applications particularly gaming applications or some utility applications from various third party app-stores which are untrustworthy. Most of the security problems are due to maliciousness of android applications.

Being used by users with varying degrees of awareness complicates the problem further. Android, one of the most popular open source mobile operating system, is facing a lot of security issues.

Wireshark android traffic