# Malware Collusion Attack against SVM: Issues and Countermeasures
## 3 Motivation
### Motivation Example  
We take a Trojan-SMS app for example to demonstrate how to perform an collusion attack. Trojan-SMS apps belong to the Trojan family and are created to steal confidential user information, such as contacts, SMS messages or passwords. The Trojan-SMS malware family is a dormitory threat in 2013 [22] and still plays an important role in current days. A typical code snippet of stealing SMS is shown in Listing 1. Usually, real malware can not only steal users' private information but also can receive commands from controllers and even attempt to exploit root permissions. The codes in Listing 1 just show one behavior of them, which is forwarding every text message the user has received to the designated server. Listing 1 declares a _BroadcastReceiver_ component. It will be launched by the system when a new SMS message is received. After it is launched, it does two main operations. The first operation is saving the information contained in the SMS message (from lines 4 to 18) to a string list _res_. The second operation is posting the information to a remote URL (lines 19 and 20). When we apply machine learning methods to detect the behavior of this app, such as Drebin [8] or HinDroid [9], these methods will extract the APIs the app has called as features, which represent the actions \(Action(z)\) of the app \(z\). As shown in Listing 1, the API calls of \"_Ljava_lang/_Runtime_getRuntime_() _Ljava_lang/_Runtime_\", \"_Ljava_lang/_Runtime_exec (_Ljava_lang/_String:_) _Ljava_lang/_Process_\", etc. will be extracted. In their detection phase, they will find that the feature of this app is much closer to malware, \(Action(z)\in Extend(\mathcal{M}^{*})\). Thus, it will be labeled as a malicious app. However, if we split the operations of this app into two or more apps, the result probably will be different. Motivated by this idea, we split the app into two apps, which are shown in Listing 2 and Listing 3, respectively. The two separated apps are connected through ICC. This communication link is denoted by \(L(app1,app2)\). If the two apps are installed on the same device, app1 will be launched by the system when an SMS message is received, then apps1 will save the content of the SMS. Next, the saved SMS is sent to app2 through ICC; finally, it will be posted to the remote server. The behavior of app1 and app2 can be denoted as \(UnionAction(app1,app2)=Action(app1)L(app1,app2)Action(app2)\). If we apply a machine learning method to detect the malicious behavior of these two apps separately, we cannot label the two apps as malicious. This is because, when we extract the feature (e.g., API calls) of a single app, the feature is much closer to a benign app, \(Action(app1)\
otin Extend(\mathcal{M}^{*})\) and \(Action(app2)\
otin Extend(\mathcal{M}^{*})\). It means just one of the two apps can not perform the malicious operation. However, if these two apps are installed on the same device, they could result in a collusion attack, \(UnionAction(app1,app2)=Action(app1)L(app1,app2)Action(app2)\in Extend( \mathcal{M}^{*})\). Thus, we need to combine the feature of the two apps to find out whether they are malicious. Note that the example above just describes how to split the behavior of stealing SMS. How about the other malicious behaviors, such as receiving commands of the remote server? Generally, the other behaviors could also be transformed in the same way to evade detection. We have developed five malware, detailed in Section 5, and manually split it into ten apps for evaluation. Figure 1 depicts this progress. Firstly, we need to analyze the malicious behavior to figure out if it is possible to separate the operation into two or more sub-procedures. Secondly, we could separate the sub-procedures into different components and connect the components by Intents and Intent Filters. Other communication channels can also be used to accomplish collusion; we just take the Intent Communication channel as an example to demonstrate this problem.