RIPDroid: Android Malware Detection Based on Permissions and IP Reputation Model

Android phones contain a lot of sensitive and private data, making them a target for hackers or other bad actors, protecting one’s privacy has become crucial to handling security for these devices. These individuals intend to build various forms of malware to take advantage of such users. Repackaging the application or designing programmes that reroute to harmful sources are some typical methods used to produce malware programmes. Therefore, we propose RIPDroid, a framework, which will identify applications based on their permissions and the IP addresses involved. Our proposed model uses permissions requested by the application and the network traffic captured during runtime to develop the overall model for the detection of android malware. The IP reputation model helps in identifying the communications made by application and the permission model aids in checking the maliciousness of the application. Our evaluation includes an overall accuracy of 95.8% for the permission-based model and an F-1 score of 90.56% for the IP reputation model.