# Detecting Colluding Inter-App Communication in Mobile Environment
## 6 Conclusions and Future Work  
The spread of smartphones has allowed the creation of a new target for cybercriminals, who are committed to constantly creating new malware in order to evade controls and gain access to people's sensitive data. In our study, investigated the colluding attack, which is based on the communication between two or more malicious applications.  
Our tool works by using formal methods to detect the presence of collusion. An automaton is generated for each class of an Android application by transforming the java bytecode instructions into CCS processes. With the model checking technique, we verify if the automata satisfy the pre-filtering properties, in this way, we obtain the set of candidate colluding applications. We then generate the \(\tau\)-automata of the candidate applications, containing the push actions useful to identify the different type of colluding attacks (_SharedPreferences_, _ExternalStorage_, _BroadcastReceiver_, and RPC), to understand if we have detected any applications capable of collusion.  
To test the performance of our method, we considered several data-sets with a total of 1092 applications, divided as follows: the ACE data-set (482 applications, all colluding), DroidBench 2.0(120 applications, no colluding), Drebin malware repository (100 non-colluding malware), [18] repository (40 applications (10 _SharedPreferences_-Int, 10 _SharedPreferences_-Float, 20 _RemoteProcedureCall_), all colluding), AMD repository (50 ransomware sample, no colluding), and a set of legitimate applications from Google Play Store (300 applications, no colluding).  
As future work, we plan to apply the proposed method on an extended set of colluding attacks, with the aim of evaluating the proposed methods effectiveness in the detection of new colluding attacks. For this reason, we plan to develop a framework to automatically inject colluding malicious payloads into legitimate Android applications, by extending the functionalities of the tool proposed by authors in [10]. Moreover, as an additional research line, we plan to investigate whether it is possible to reduce the actions of automata to apply formal equivalence checking for colluding detection. One of the limitations of our method is that the generation of the first heuristic is not automatic. In fact, new collusion attacks require the security analyst to first formulate a formula for the identification. The first formula is used as a heuristic to filter all classes that perform \(GET\) and \(PUT\) actions, for this reason, the method can also work by considering only the second heuristic (the automatic property generation); however, more computational time will be required.  
Conceptualization, R.C., F.M. ([PERSON]), F.M. ([PERSON]) and A.S.; methodology, R.C., F.M. ([PERSON]), F.M. ([PERSON]), A.S.; software, R.C., F.M. ([PERSON]); validation, R.C., F.M. ([PERSON]), F.M. ([PERSON]) and A.S.; formal analysis, R.C., F.M. ([PERSON]) and A.S.; investigation, R.C., F.M. ([PERSON]), F.M. ([PERSON]) and A.S.; resources, R.C., F.M. ([PERSON]), F.M. ([PERSON]) and A.S.; data curation, R.C., F.M. ([PERSON]), F.M. ([PERSON]) and A.S.; writing-original draft preparation, R.C., F.M. ([PERSON]), F.M. ([PERSON]) and A.S.; writing-review and editing, R.C., F.M. ([PERSON]), F.M. ([PERSON]) and A.S.; visualization, R.C., F.M. ([PERSON]), F.M. ([PERSON]) and A.S.; supervision, F.M. ([PERSON]) and A.S.; project administration, F.M. ([PERSON]) and A.S.; funding acquisition, F.M. ([PERSON]). All authors have read and agreed to the published version of the manuscript.  
This work has been partially supported by MIUR - SecureOpenNets, EU SPARTA, CyberSANE and E-CORRIDOR projects.  
The authors declare no conflict of interest.