
Exploring the Potential of Big Data for Malware Detection
417
any deviation, whereas the server-side software is responsible for comparing the behavior of the
new application against the application’s known traffic patterns in order to identify whether the
application is acting benignly or it is a malware modification of the previous benign application.
Local learning is carried out on the smartphone, and the local-side software is implemented as
a full-fledged Android OS running on the device. An overview of the client-side software is
shown in Figure 17.12.
The system architecture (at the client side) consists of a client app that is installed on