City Research Online

Detection of app collusion potential using logic programming

Blasco, J., Chen, T. ORCID: 0000-0001-8037-1685, Muttik, I. & Roggenbach, M. (2018). Detection of app collusion potential using logic programming. Journal of Network and Computer Applications, 105, pp. 88-104. doi: 10.1016/j.jnca.2017.12.008


Mobile devices pose a particular security risk because they hold personal details (accounts, locations, contacts, photos) and have capabilities potentially exploitable for eavesdropping (cameras/microphone, wireless connections). The Android operating system is designed with a number of built-in security features such as application sandboxing and permission-based access control. Unfortunately, these restrictions can be bypassed, without the user noticing, by colluding apps whose combined permissions allow them to carry out attacks that neither app is able to execute by itself.

While the possibility of app collusion was first warned in 2011, it has been unclear if collusion is used by malware in the wild due to a lack of suitable detection methods and tools. This paper describes how we found the first collusion in the wild. We also present a strategy for detecting collusions and its implementation in Prolog that allowed us to make this discovery.

Our detection strategy is grounded in concise definitions of collusion and the concept of ASR (Access-Send-Receive) signatures. The methodology is supported by statistical evidence. Our approach scales and is applicable to inclusion into professional malware detection systems: we applied it to a set of more than 50,000 apps collected in the wild. Code samples of our tool as well as of the detected malware are available.

Publication Type: Article
Additional Information: © 2017 Elsevier Ltd. This manuscript version is made available under the CC-BY-NC-ND 4.0 license
Publisher Keywords: Android, Collusion, Malware, MoPlus
Departments: School of Science & Technology > Engineering
SWORD Depositor:
[thumbnail of jnca_final.pdf]
Text - Accepted Version
Available under License Creative Commons Attribution Non-commercial No Derivatives.

Download (1MB) | Preview


Add to AnyAdd to TwitterAdd to FacebookAdd to LinkedinAdd to PinterestAdd to Email


Downloads per month over past year

View more statistics

Actions (login required)

Admin Login Admin Login