Detection of App Collusion Potential Using Logic Programming
This addresses a security risk for Android users by providing a scalable filtering approach to identify potential app collusion, though it is incremental as it builds on existing methods like taint analysis.
The paper tackles the problem of detecting potential collusion between Android apps, where apps might cooperate to bypass security features like sandboxing, and presents a method using logic programming to filter suspicious app sets, validated on manually crafted apps and scaled to over 50,000 real apps, detecting a large set of real apps using collusion for synchronization.
Android is designed with a number of built-in security features such as app sandboxing and permission-based access controls. Android supports multiple communication methods for apps to cooperate. This creates a security risk of app collusion. For instance, a sandboxed app with permission to access sensitive data might leak that data to another sandboxed app with access to the internet. In this paper, we present a method to detect potential collusion between apps. First, we extract from apps all information about their accesses to protected resources and communications. Then we identify sets of apps that might be colluding by using rules in first order logic codified in Prolog. After these, more computationally demanding approaches like taint analysis can focus on the identified sets that show collusion potential. This "filtering" approach is validated against a dataset of manually crafted colluding apps. We also demonstrate that our tool scales by running it on a set of more than 50,000 apps collected in the wild. Our tool allowed us to detect a large set of real apps that used collusion as a synchronization method to maximize the effects of a payload that was injected into all of them via the same SDK.