# Malware Collusion Attack against SVM: Issues and Countermeasures
## 6 Related Works  
In this section, we discussed other research efforts that are related to this work. These efforts include malware detection and collusion detection.  
Over the past few years, there have been several approaches introduced to analyze collusion apps. [PERSON] et al. [4] was the first article to investigate collusion problems. It studied the security challenges of Android communication and developed ComDroid to detect those vulnerabilities through static analysis of each app. Furthermore, [PERSON] et al. [29] developed Epicc for the study of Intent properties by introducing the use of inter-procedural data flow analysis. FlowDroid [3] introduces a novel on-demand data flow analysis algorithm with high efficiency and precision. IceTa [31] extends  
Figure 8: Analyzing time of FlowDroid. (**a**) analyzing time of FlowDroid; (**b**) cumulative distribution function.  
\begin{table}
\begin{tabular}{c c} \hline
**Items** & **Time** \\ \hline feature extraction & Refer to Figure 7a \\   model training & Linear-SVM: 0.45 s \\  & Sec-SVM: 23.45 s \\ communication links computing & 20.53 s \\   malware detection & 0.02 ms \\ \hline \end{tabular}
\end{table}
Table 3: Analysis time of ColluDroid in each step.  
Figure 7: Feature extraction time of ColluDroid. (**a**) feature extraction time; (**b**) cumulative distribution function.  
the work of FlowDroid to make it able to detect inter-component vulnerabilities. With the help of ApkCombiner [32], IccTa can also be used to identify inter-app vulnerabilities (Collusion).  
These efforts above mainly focus on the static-analysis of applications. There are also many dynamic-analysis based methods that have been proposed. Generally, they analyze an app by running it on an emulator and monitor its running behavior. TaintDroid [33] is the pioneering work that introduces dynamic taint analysis on Android. VetDroid [34] is built on TaintDroid and analyzes an app's permission use. IntelliDroid is a tool that can be used to generate specific inputs for dynamic analysis tool such as TaintDroid to cover more paths and behavior. CopperDroid [6] is built on technique Virtual Machine Introspection and performs system call-centric dynamic analysis of Android apps to detect malicious behavior.  
However, both static and dynamic based analysis methods have the scalability problem. Static-analysis methods rely on data flow analysis, which is very time-consuming. According to our experiment, analyzing a 10 MB size app will take more than 10 minutes. [PERSON] et al. [35] have also gotten a similar result. As the app becomes larger, the time required for analysis will increase exponentially. For dynamic-Analysis based methods, they have a code coverage problem, which means that it takes hours for them to explore a single app [36]. In order to find collusion apps, we need to examine thousands of apps; the time cost will be unacceptable for traditional methods.  
On the other hand, the machine learning methods [8; 9] have advantages both in accuracy and efficiency. However, the current machine learning method does not consider the collusion threat. Therefore, this paper investigates the use of machine learning-based methods to detect collusion apps.