ACDroid: Detecting Collusion Applications on Smart Devices

With the continuous innovation of artificial intelligence technology, more and more smart devices are being applied to emerging industrial Internet and IOT (Internet of Things) platforms. Most of these smart devices are designed based on the Android framework, and the security of Android applications is particularly important for these smart devices. To facilitate communication between applications, ICC (Inter-Component Communication) is widely used in Android. While bringing convenience to users, it also brings the risk of privacy leakage and privilege escalation. In this way, two or more applications can collude and thereby evade detection by tools that analyze the security of a single application. To defend against this attack, we propose a machine learning-based static analysis method and design and implement ACDroid. ACDroid uses static analysis to obtain inter-application collaboration characteristics, including inter-application ICCs and dangerous permission group combinations. The deep learning algorithm is then used for efficient classification to detect collusion attacks. ACDroid improves the detection performance of existing research focusing on single permission features via constructing synergistic components. We validate our tool by conducting experiments on over 10,000 real-world applications. Compared with state-of-the-art approaches, our method expresses superior performance in collusion attack detection.