# Detecting Colluding Inter-App Communication in Mobile Environment
## 5 State-Of-The-Art Literature  
The anti-malware detection techniques actually converge their attention on the analysis of one sample at a time, which excludes the presence of communication channels between the applications. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Precision** & **Recall** & **F-Measure** & **Specificity** & **Accuracy** \\ \hline
1 & 1 & 1 & 1 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Performance results. The research community is working on Inter-Component Communication to develop innovative tools and methods to identify these channels. A particular kind of colluding attack is characterized by _covert channel_; the authors in [31], developed a multichannel communication mechanism to transfer sensitive data securely on mobile devices, called the Multichannel Communication System (MSYM). It uses the VpnService interface ([[https://developer.android.com/reference/android/net/VpnService](https://developer.android.com/reference/android/net/VpnService)]([https://developer.android.com/reference/android/net/VpnService](https://developer.android.com/reference/android/net/VpnService))) provided by the Android platform, and thus is able to intercept the network data sent and then split it into different parts that will be disordered and encrypted through multiple transmission channels. The accelerometer sensor represents a type of covert channel and is able to generate signals that reflect users' motions. These data can be read by malicious applications, but correctly using the device's vibration engine, the stolen data can be encrypted, so one application can cause acceleration data to be received and decrypted by another application. For this reason, two Android applications (representing the source and the sink, respectively) were developed and [32] tested on three different smartphone models to verify this type of communication. Usually the covert channels are divided into the covert storage channel and covert timing channel [33]. The difference is that:  
* the covert storage channel hides the secret information in the data transmission protocol and achieves covert communication using payload or non-payload fields:
* the covert timing channel encodes the secret information and achieves the covert communication using the time gap between packets. There are many methods able to detect specific covert timing channels, but the authors in [34] worked to perform the filtering, grouping, and other operations regarding the communication packets. They also chose a suitable machine learning algorithm to train the classification model, obtaining good detection performance. The magnetometers, better known as magnetic sensors found in devices such as smartphones and tablets are typically used for positioning and orientation. They can be exploited by the attackers to exfiltrate information from isolated and non-networked computers. MAGNETO [35] is a proposal of covert communication about air-gapped systems and nearby smartphones via magnetic fields generated from the CPU. The magnetic signals can be generated from the computers changing the CPU workload, but this covert channel works only for short distances and with low transmission rate. It is effective in unconstrained environments having the wireless communications blocked. TaintDroid [1] is an extension of the Android operating system and specifically tracks the flow of privacy-sensitive data passing through third-party applications. In most cases, downloaded third-party applications are not reliable, which is why the approach monitors, in real time, how these applications access users' personal data and manipulate them. Inter-Component Communication based Taint Analysis tool (IccTA) [36] is a tool that uses the static taint analysis technique, its goal is to recover paths where privacy and sensitive information are sent outside without users being aware and therefore without their permission. The approach is able to detect paths within a single component or between multiple components.