Skip to main content
SpringerLink
Log in

Colluding Android Apps Detection via Model Checking

  • Conference paper
  • First Online:
Web, Artificial Intelligence and Network Applications (WAINA 2020)

Part of the book series: Advances in Intelligent Systems and Computing ((AISC,volume 1150))

Abstract

The application collusion attack is a new form of threat that is becoming widespread in mobile environment. This technique requires that two or more apps cooperate in some way with the aim to perform a malicious action that they are unable to perform independently. In this paper we present a method exploiting the model checking technique aimed to detect whether two or more apps are performing a collusion attack. We also propose a heuristic function able to reduce the number of the analyzed apps and to localize the collusion. The preliminary investigation has brought very promising results.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 229.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 299.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://sourceforge.net/projects/dex2jar/.

  2. 2.

    https://docs.oracle.com/javase/8/docs/technotes/tools/unix/jar.html.

  3. 3.

    https://commons.apache.org/proper/commons-bcel/.

References

  1. Amato, F., Castiglione, A., De Santo, A., Moscato, V., Picariello, A., Persia, F., Sperlí, G.: Recognizing human behaviours in online social networks. Comput. Secur. 74, 355–370 (2018)

    Article  Google Scholar 

  2. Amato, F., Moscato, F., Moscato, V., Colace, F.: Improving security in cloud by formal modeling of IaaS resources. Future Gener. Comput. Syst. 87, 754–764 (2018)

    Article  Google Scholar 

  3. Andersen, J.R., Andersen, N., Enevoldsen, S., Hansen, M.M., Larsen, K.G., Olesen, S.R., Srba, J., Wortmann, J.K.: CAAL: concurrency workbench, Aalborg edition. In: Proceedings of the Theoretical Aspects of Computing - ICTAC 2015 - 12th International Colloquium Cali, Colombia, 29–31 October 2015. LNCS, vol. 9399, pp. 573–582. Springer (2015)

    Google Scholar 

  4. Asavoae, I.M., Blasco, J., Chen, T.M., Kalutarage, H.K., Muttik, I., Nguyen, H.N., Roggenbach, M., Shaikh, S.A.: Towards automated Android app collusion detection. In: Proceedings of the 1st International Workshop on Innovations in Mobile Privacy and Security, IMPS 2016, co-located with the International Symposium on Engineering Secure Software and Systems (ESSoS 2016), London, UK, 6 April 2016, pp. 29–37 (2016)

    Google Scholar 

  5. Barbuti, R., De Francesco, N., Santone, A., Vaglini, G.: LORETO: a tool for reducing state explosion in verification of LOTOS programs. Softw. Pract. Exper. 29(12), 1123–1147 (1999)

    Article  Google Scholar 

  6. Barbuti, R., De Francesco, N., Santone, A., Vaglini, G.: Reduced models for efficient CCS verification. Formal Methods Syst. Des. 26(3), 319–350 (2005)

    Article  MATH  Google Scholar 

  7. Battista, P., Mercaldo, F., Nardone, V., Santone, A., Visaggio, C.A.: Identification of Android malware families with model checking. In: Proceedings of the 2nd International Conference on Information Systems Security and Privacy, ICISSP, vol. 1, pp. 542–547 (2016)

    Google Scholar 

  8. Blasco, J., Chen, T.M.: Automated generation of colluding apps for experimental research. J. Comput. Virol. Hacking Tech. 14(2), 127–138 (2018)

    Article  Google Scholar 

  9. Bugiel, S., Davi, L., Dmitrienko, A., Fischer, T., Sadeghi, A.-R., Shastry, B.: Towards taming privilege-escalation attacks on Android. In: NDSS, vol. 17, p. 19. Citeseer (2012)

    Google Scholar 

  10. Canfora, G., Martinelli, F., Mercaldo, F., Nardone, V., Santone, A., Visaggio, C.A.: LEILA: formal tool for identifying mobile malicious behaviour. IEEE Trans. Softw. Eng. 45(12), 1230–1252 (2018)

    Article  Google Scholar 

  11. Canfora, G., Medvet, E., Mercaldo, F., Visaggio, C.A.: Detecting Android malware using sequences of system calls. In: Proceedings of the 3rd International Workshop on Software Development Lifecycle for Mobile, pp. 13–20. ACM (2015)

    Google Scholar 

  12. Canfora, G., Mercaldo, F., Visaggio, C.A.: Mobile malware detection using op-code frequency histograms. In: 2015 12th International Joint Conference on e-Business and Telecommunications (ICETE), vol. 4, pp. 27–38. IEEE (2015)

    Google Scholar 

  13. Casolare, R., Martinelli, F., Mercaldo, F., Santone, A.: A model checking based proposal for mobile colluding attack detection. In: IEEE BigData (2019, in press)

    Google Scholar 

  14. Ceccarelli, M., Cerulo, L., Santone, A.: De novo reconstruction of gene regulatory networks from time series data, an approach based on formal methods. Methods 69(3), 298–305 (2014)

    Article  Google Scholar 

  15. Chin, E., Felt, A.P., Greenwood, K., Wagner, D.: Analyzing inter-application communication in Android. In: Proceedings of the 9th International Conference on Mobile Systems, Applications, and Services, pp. 239–252. ACM (2011)

    Google Scholar 

  16. Clarke, E.M., Grumberg, O., Peled, D.: Model Checking. MIT Press, Cambridge (2001)

    Book  MATH  Google Scholar 

  17. de Francesco, N., Lettieri, G., Santone, A., Vaglini, G.: GreASE: a tool for efficient “nonequivalence” checking. ACM Trans. Softw. Eng. Methodol. (TOSEM) 23(3), 24 (2014)

    Article  Google Scholar 

  18. Marforio, C., Ritzdorf, H., Francillon, A., Capkun, S.: Analysis of the communication between colluding applications on modern smartphones. In: Proceedings of the 28th Annual Computer Security Applications Conference, pp. 51–60. ACM (2012)

    Google Scholar 

  19. Memon, A.M., Anwar, A.: Colluding apps: tomorrow’s mobile malware threat. IEEE Secur. Priv. 13(6), 77–81 (2015)

    Article  Google Scholar 

  20. Mercaldo, F., Nardone, V., Santone, A., Visaggio, C.A.: Ransomware steals your phone. Formal methods rescue it. In: Proceedings of the Formal Techniques for Distributed Objects, Components, and Systems - 36th IFIP WG 6.1 International Conference, FORTE 2016, Held as Part of the 11th International Federated Conference on Distributed Computing Techniques, DisCoTec 2016, Heraklion, Crete, Greece, 6–9 June 2016. LNCS, vol. 9688, pp. 212–221. Springer (2016)

    Google Scholar 

  21. Mercaldo, F., Santone, A.: Deep learning for image-based mobile malware detection. J. Comput. Virol. Hacking Tech. 1–15 (2020)

    Google Scholar 

  22. Milner, R.: Communication and Concurrency. PHI Series in Computer Science. Prentice Hall, Upper Saddle River (1989)

    MATH  Google Scholar 

  23. Sbîrlea, D., Burke, M.G., Guarnieri, S., Pistoia, M., Sarkar, V.: Automatic detection of inter-application permission leaks in Android applications. IBM J. Res. Dev. 57(6), 10–1 (2013)

    Article  Google Scholar 

  24. Stirling, C.: An introduction to modal and temporal logics for CCS. In: Yonezawa, A., Ito, T. (eds.) Concurrency: Theory, Language, and Architecture. LNCS, vol. 491, pp. 2–20. Springer (1989)

    Google Scholar 

  25. Xu, K., Li, Y., Deng, R.H.: ICCDetector: ICC-based malware detection on Android. IEEE Trans. Inf. Forensics Secur. 11(6), 1252–1264 (2016)

    Article  Google Scholar 

  26. Zhou, Y., Wang, Z., Zhou, W., Jiang, X.: Hey, you, get off of my market: detecting malicious apps in official and alternative Android markets. In: NDSS, vol. 25, pp. 50–52 (2012)

    Google Scholar 

Download references

Acknowledgments

This work has been partially supported by MIUR - SecureOpenNets and EU SPARTA and CyberSANE projects.

Author information

Authors and Affiliations

  1. Department of Biosciences and Territory, University of Molise, Pesche, IS, Italy

    Rosangela Casolare, Francesco Mercaldo & Antonella Santone

  2. Institute for Informatics and Telematics, National Research Council of Italy (CNR), Pisa, Italy

    Fabio Martinelli & Francesco Mercaldo

  3. Department of Engineering, University of Sannio, Benevento, Italy

    Vittoria Nardone

Authors
  1. Rosangela Casolare
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Fabio Martinelli
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Francesco Mercaldo
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Vittoria Nardone
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Antonella Santone
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Francesco Mercaldo .

Editor information

Editors and Affiliations

  1. Department of Information and Communication Engineering, Fukuoka Institute of Technology, Fukuoka, Japan

    Leonard Barolli

  2. Department of Electrical Engineering and Information Technology, University of Naples “Frederico II”, Naples, Italy

    Flora Amato

  3. Department of Political Science, University of Campania Luigi Vanvitelli, Caserta, Italy

    Francesco Moscato

  4. Faculty of Business Administration, Rissho University, Tokyo, Japan

    Tomoya Enokido

  5. Department of Advanced Sciences, Hosei University, Tokyo, Japan

    Makoto Takizawa

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Casolare, R., Martinelli, F., Mercaldo, F., Nardone, V., Santone, A. (2020). Colluding Android Apps Detection via Model Checking. In: Barolli, L., Amato, F., Moscato, F., Enokido, T., Takizawa, M. (eds) Web, Artificial Intelligence and Network Applications. WAINA 2020. Advances in Intelligent Systems and Computing, vol 1150. Springer, Cham. https://doi.org/10.1007/978-3-030-44038-1_71

Download citation

Publish with us

Policies and ethics

Search

Navigation