
Exploring the Potential of Big Data for Malware Detection
407
radio services (GPRS), 3/4G, and/or Wi-Fi networks. The detection algorithm in the distributed
servers will identify the possible threat and send the result to the major servers, and then the
servers will notify the concerned terminals.
The basic framework of SmartMal is divided into two architectures: client and server.
1. Client architecture: The main function of the client is to extract abnormal features.
Feature extractor is the main module of the client, and the features are extracted through
APIs that are provided by the Android application or from the Linux kernel. The
extracted