# Malware Collusion Attack against SVM: Issues and Countermeasures
## 1 Introduction  
Malware has become a rising problem in the Android Operating System, according to the report released by Macee in 2017 [1]. Currently, the popularity of Android devices makes it a desirable target. Kaspersky Lab also reported that it had detected 1,598,196 malicious installation packages in the third quarter of 2017, which is 1.2 times more than in the previous quarter [2]. Enormous methods have been proposed to detect this malware, such as static-analysis methods, dynamic-analysis methods, and machine learning based methods. Generally, static-analysis methods [3, 4] examine an app by decompiling the app and then analyze the source codes; dynamic-analysis methods [5, 6, 7] analyze them by running them on an emulator and monitor the status of the emulator; and machine learning based methods [8, 9, 10] are to classify features that are extracted by static or dynamic analysis methods. Malware developers may develop a pair of apps to evade detection. Each of them only needs to request minimum privileges, which make it appear closer to a benign one. We call these apps _Collusion Apps_ and this kind of attack _Collusion Attack_. Apart from Collusion attack, malware developers may also have the incentive to hide its malicious behavior by using some advanced techniques such as obfuscation, dynamic code loading, etc. This kind of attack is called _Evasion Attack_. Researchers have reported some real collusion apps in recent years. The first known example is named Soundcomber [11]. The first app stole sensitive data such as credit card numbers or Postal Index Numbers (PINs). Then, it sent it to another app that has the permission of accessing the Internet and finally sent out of the device through the Internet. Another example of collusion in the wild was released in 2015 [12] by WooYun.org, a vulnerability reporting platform in China. It reported that any app with Moplus software development kit (SDK) would collude to start an HTTP server in the background on Android devices and can receive commands from outside. Moplus SDK is popular and has been integrated into numerous Android apps, which means that the apps contain this SDK will be able to conduct a Collusion Attack. It affects a large number of Android devices. Machine learning based methods, such as Drebin [8], DenDroid [13], HinDroid [9], etc. have a significant advantage in detecting the similarity between apps. As a result, they can be used for malware classification tasks. According to their results, they can achieve 95% or even higher accuracy just based on Support Vector Machines (SVM). However, they cannot detect collusion malware. Actually, Collusion Attack is quite useful to evade their detection. We evaluate the effectiveness of Collusion Attack by simulation. According to our simulation results, 87.4% of apps can evade Linear-SVM by performing two apps collusion. If attackers perform three apps collusion, the result will come to 94.8%. Thus, in this paper, we proposed ColluDroid to detect the malware collusion attack. We screen out the apps that may have potential intent to collude by analyzing the communications links between apps. If we have found that two apps may communicate through any channel, then we examine the two apps as a whole by combining their features. In our experiment, we evaluated the effectiveness of ColluDroid. It can successfully find our manually made collusion apps, where other methods cannot. In addition, the speed is 15 times faster than traditional data-flow based methods and we believe that it can be applied to analyze the collusion apps on a large scale. On the other hand, if attackers perform Collusion Attack, they also may perform Evasion Attack. Previous work has already investigated the effect of Evasion Attack on learning methods in different applications [14; 15; 16; 17]. However, as far as we know, they haven't studied the evasion attack at the presence of collusion. In our work, we evaluate the performance of ColluDroid with different learning methods (Linear SVM and Sec-SVM).