# Malware Collusion Attack against SVM: Issues and Countermeasures
## 4 Architecture of ColluDroid
### Detection Phase
#### 4.2.1 Extract Communication Links  
In Section 2, we have introduced some overt communication channels. Now, we need to extract these properties from an APK file and find out which app may have the potential to communicate with other apps.  
_Intents and Intents Filters Extraction._ The idea of resolving Intents is using a static analysis tool such as Soot framework [28] to locate where the intent is sent (line 20 in Listing 2) and then perform a static constant propagation to determine the properties of the Intent. As for resolving the properties of Intent Filters, it is much simpler. We analyze the Intent Filters declared in _AndroidManifest.xml_ file. Note that resolving the Intent Filters of _Broadcast Receiver_ is a bit more complex, as we not only need to analyze the _AndroidManifest.xml_ but also need to analyze the codes because _Broadcast Receiver_ is allowed to register dynamically in codes.  
Figure 4 shows a description of Intents and Intent Filters extracted in this section. Some components may not declare Intent Filter in _AndroidManifest.xml_ file, but they can still receive explicit intent. Thus, we generate a default Intent Filter for them, in order to handle explicit Intents generically. Every component has at least one Intent Filter with an Application Name and a Component Name attribute.  
In our running example, Activity1 declares one explicit intent, and there are two components in total. Thus, there is one Intent and two Intent Filters extracted.  
_ICC communication computation._ Matching explicit intents is straightforward. We just need to match the target application field and target component field of Intents with the application name field and component name field of Intent filters. While matching implicit intent is a bit complex, the resolution of an implicit intent involves matching the action, category and data fields with a  
Figure 4: Intent and Intent Filters.  
compatible IntentFilter, known in the Android development guide as action test, category test, and data test, respectively.  
Examples of such analysis tools include ComDroid [4], EPIC [29] and IC3 [30]. We choose IC3 for Parser in this work. Every link is extracted in the form of a four-tuple \(\langle\)sender app, sender component, receiver app, and receiver component\(\rangle\).  
_Shared Preference Extraction._ We extract the app's shared preferences by track the parameters of the API _getSharedPreferences()_. _getSharedPreferences()_ has two parameters, the first one is the name of preferences file and the second one is the file's open mode. We only extract the name of the preferences file when its open mode is _MODE_WORLD_READABLE_ or _MODE_WORLD_WRITEABLE_. If we cannot extract the preferences file name by static analysis, we will refer to the name as \"*\", which means it can be stored as whatever the app wants to.  
_Shared Preference Communication Computation._ In this procedure, we find the app pairs that have the potential to read or write the same preferences file. If the file name is \"*\", it means that this app has the potential to communicate with any app that has read or write shared preferences files.