Detecting Colluding Inter-App Communication in Mobile Environment
Source abstract
Abstract
The increase in computing capabilities of mobile devices has, in the last few years, made possible a plethora of complex operations performed from smartphones and tablets end users, for instance, from a bank transfer to the full management of home automation. Clearly, in this context, the detection of malicious applications is a critical and challenging task, especially considering that the user is often totally unaware of the behavior of the applications installed on their device. In this paper, we propose a method to detect inter-app communication i.e., a colluding communication between different applications with data support to silently exfiltrate sensitive and private information. We based the proposed method on model checking, by representing Android applications in terms of automata and by proposing a set of logic properties to reduce the number of comparisons and a set of logic properties automatically generated for detecting colluding applications. We evaluated the proposed method on a set of 1092 Android applications, including different colluding attacks, by obtaining an accuracy of 1, showing the effectiveness of the proposed method.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Software Testing and Debugging Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Biosciences and Territory, University of Molise, 86090 Pesche, Italy
Institute for Informatics and Telematics, National Research Council of Italy, 56124 Pisa, Italy
Department of Medicine and Health Sciences “Vincenzo Tiberio”, University of Molise, 86100 Campobasso, Italy
References (46)
Show source-provided references
1. TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones10.1145/2619091 ↗
2. Arabo, A., and Pranggono, B. (2013, January 29–31). Mobile malware and smart device security: Trends, challenges and solutions. Proceedings of the 2013 19th International Conference on Control Systems and Computer Science, Bucharest, Romania.10.1109/CSCS.2013.27 ↗
3. Enck, W. (, January Kolkata,). Defending users against smartphone apps: Techniques and future directions. Proceedings of the International Conference on Information Systems Security, 15–19 December 2011.10.1007/978-3-642-25560-1_3 ↗
4. Arabo, A., Brown, I., and El-Moussa, F. (2012, January 3–5). Privacy in the age of mobility and smart devices in smart homes. Proceedings of the 2012 International Conference on Privacy, Security, Risk and Trust and 2012 International Confernece on Social Computing, Amsterdam, The Netherlands.10.1109/SocialCom-PASSAT.2012.108 ↗
5. Nguyen, T., Mcdonald, J., Glisson, W., and Andel, T. (2020, January 7–10). Detecting Repackaged Android Applications Using Perceptual Hashing. Proceedings of the 53rd Hawaii International Conference on System Sciences, Maui, HI, USA.10.24251/HICSS.2020.813 ↗
6. Talos: No more ransomware victims with formal methods10.1007/s10207-017-0398-5 ↗
7. Leila: Formal tool for identifying mobile malicious behaviour10.1109/TSE.2018.2834344 ↗
8. Mercaldo, F., Visaggio, C.A., Canfora, G., and Cimitile, A. (2016, January 14–22). Mobile malware detection in the real world. Proceedings of the 2016 IEEE/ACM 38th International Conference on Software Engineering Companion (ICSE-C), Austin, TX, USA.10.1145/2889160.2892656 ↗
9. Model checking for malicious family detection and phylogenetic analysis in mobile environment10.1016/j.cose.2019.101691 ↗
10. Automated generation of colluding apps for experimental research10.1007/s11416-017-0296-4 ↗
11. Iccdetector: Icc-based malware detection on android10.1109/TIFS.2016.2523912 ↗
12. Marforio, C., Ritzdorf, H., Francillon, A., and Capkun, S. (2012, January 3–7). Analysis of the communication between colluding applications on modern smartphones. Proceedings of the 28th Annual Computer Security Applications Conference, Orlando, FL, USA.10.1145/2420950.2420958 ↗
13. Casolare, R., Martinelli, F., Mercaldo, F., and Santone, A. (2019, January 9–12). A Model Checking based Proposal for Mobile Colluding Attack Detection. Proceedings of the 2019 IEEE International Conference on Big Data (Big Data), Los Angeles, CA, USA.10.1109/BigData47090.2019.9006094 ↗
14. Feng, H., and Shin, K.G. (2016, January 5–9). Understanding and defending the Binder attack surface in Android. Proceedings of the 32nd Annual Conference on Computer Security Applications, Los Angeles, CA, USA.10.1145/2991079.2991120 ↗
15. EspyDroid+: Precise reflection analysis of android apps10.1016/j.cose.2019.101688 ↗
16. Colluding apps: Tomorrow’s mobile malware threat10.1109/MSP.2015.143 ↗
17. Bosu, A., Liu, F., Yao, D., and Wang, G. (2017, January 2–6). Collusive data leak and more: Large-scale threat analysis of inter-app communications. Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, Abu Dhabi, UAE.10.1145/3052973.3053004 ↗
18. Casolare, R., Martinelli, F., Mercaldo, F., and Santone, A. (2020). Android Collusion: Detecting Malicious Applications Inter-Communication through SharedPreferences. Information, 11.10.3390/info11060304 ↗
19. Asavoae, I.M., Blasco, J., Chen, T.M., Kalutarage, H.K., Muttik, I., Nguyen, H.N., Roggenbach, M., and Shaikh, S.A. (2016). Towards automated android app collusion detection. arXiv.
20. Milner, R. (1989). Communication and Concurrency, Prentice Hall.
21. Stirling, C. (1989). An Introduction to Modal and Temporal Logics for CCS. Concurrency: Theory, Language, and Architecture, Springer.10.1007/BFb0013039 ↗
22. Heuristic search for equivalence checking10.1007/s10270-014-0416-2 ↗
23. Android data storage security: A review
24. Kumar, S., and Shukla, S.K. (2020). The State of Android Security. Cyber Security in India, Springer.10.1007/978-981-15-1675-7_2 ↗
25. Evaluating model checking for cyber threats code obfuscation identification10.1016/j.jpdc.2018.04.008 ↗
26. Bacci, A., Bartoli, A., Martinelli, F., Medvet, E., and Mercaldo, F. (2018, January 27–30). Detection of obfuscation techniques in Android applications. Proceedings of the 13th International Conference on Availability, Reliability and Security, Hamburg, Germany.10.1145/3230833.3232823 ↗
27. Bacci, A., Bartoli, A., Martinelli, F., Medvet, E., Mercaldo, F., and Visaggio, C.A. (2018, January 22–24). Impact of Code Obfuscation on Android Malware Detection based on Static and Dynamic Analysis. Proceedings of the ICISSP, Madeira, Portugal.10.5220/0006642503790385 ↗
28. Visualizing the outcome of dynamic analysis of Android malware with VizMal
29. Canfora, G., De Lorenzo, A., Medvet, E., Mercaldo, F., and Visaggio, C.A. (2015, January 24–28). Effectiveness of opcode ngrams for detection of multi family android malware. Proceedings of the 2015 10th International Conference on Availability, Reliability and Security, Toulouse, France.10.1109/ARES.2015.57 ↗
30. Drebin: Effective and explainable detection of android malware in your pocket
31. MSYM: A multichannel communication system for android devices10.1016/j.comnet.2019.107024 ↗
32. A new sensors-based covert channel on android
33. A support vector machine-based framework for detection of covert timing channels10.1109/TDSC.2015.2423680 ↗
34. Covert timing channel detection method based on time interval and payload length analysis10.1016/j.cose.2020.101952 ↗
35. Guri, M. (2020). Magneto: Covert channel between air-gapped systems and nearby smartphones via cpu-generated magnetic fields. Future Gener. Comput. Syst.10.1016/j.future.2020.08.045 ↗
36. Iccta: Detecting inter-component privacy leaks in android apps10.1109/ICSE.2015.48 ↗
37. Amandroid: A precise and general inter-component data flow analysis framework for security vetting of android apps10.1145/3183575 ↗
38. Information flow analysis of android applications in droidsafe
39. Liu, F., Cai, H., Wang, G., Yao, D., Elish, K.O., and Ryder, B.G. (2017, January 25–25). MR-Droid: A scalable and prioritized analysis of inter-app communication risks. Proceedings of the 2017 IEEE Security and Privacy Workshops (SPW), San Jose, CA, USA.10.1109/SPW.2017.12 ↗
40. Bhandari, S., Herbreteau, F., Laxmi, V., Zemmari, A., Roop, P.S., and Gaur, M.S. (2017, January 1–4). Sneakleak: Detecting multipartite leakage paths in android apps. Proceedings of the 2017 IEEE Trustcom/BigDataSE/ICESS, Sydney, Australia.10.1109/Trustcom/BigDataSE/ICESS.2017.249 ↗
41. Arabo, A. (2016, January 25–27). Mobile App collusions and its cyber security implications. Proceedings of the 2016 IEEE 3rd International Conference on Cyber Security and Cloud Computing (CSCloud), Beijing, China.10.1109/CSCloud.2016.9 ↗
42. Xu, M., Ma, Y., Liu, X., Lin, F.X., and Liu, Y. (2017, January 3–7). AppHolmes: Detecting and characterizing app collusion among third-party Android markets. Proceedings of the 26th International Conference on World Wide Web, Perth, Australia.10.1145/3038912.3052645 ↗
43. Aktas, K., and Sen, S. (2018, January 28–30). Updroid: Updated android malware and its familial classification. Proceedings of the Nordic Conference on Secure IT Systems, Oslo, Norway.10.1007/978-3-030-03638-6_22 ↗
44. Mercaldo, F., Nardone, V., Santone, A., and Visaggio, C.A. (2016, January 15). Download malware? no, thanks: How formal methods can block update attacks. Proceedings of the 4th FME Workshop on Formal Methods in Software Engineering, Austin, TX, USA.10.1145/2897667.2897673 ↗
45. Mercaldo, F., Nardone, V., Santone, A., and Visaggio, C.A. (2016, January 6–9). Ransomware steals your phone. Formal methods rescue it. Proceedings of the International Conference on Formal Techniques for Distributed Objects, Components, and Systems, Heraklion, Greece.10.1007/978-3-319-39570-8_14 ↗
46. Detecting Ransomware Using Process Behavior Analysis10.1016/j.procs.2020.02.249 ↗