[Paper Review] Android Inter-App Communication Threats, Solutions, and Challenges

Jice Wang, Hongqi Wu|arXiv (Cornell University)|Mar 13, 2018

Advanced Malware Detection Techniques10 references3 citations

TL;DR

This paper investigates Android inter-app communication threats, particularly app collusion, where malicious apps collaborate via system-provided channels to bypass traditional single-app malware detection. It analyzes Android's communication mechanisms, identifies security vulnerabilities, surveys state-of-the-art detection solutions, and outlines key challenges in detecting coordinated app behavior, contributing a comprehensive framework for understanding and mitigating collusion-based attacks.

ABSTRACT

Researchers and commercial companies have made a lot of efforts on detecting malware in Android platform. However, a recent malware threat, App collusion, makes malware detection challenging. In App collusion, two or more Apps collaborate to perform malicious actions by communicating with each other, which makes single App analysis insufficient. In this paper, we first introduce Android security mechanism and communication channels used by android Applications. Then we summarize the security vulnerabilities and potential threats introduced by App communication. Finally, we discuss state of art researches and challenges on App collusion detection.

Motivation & Objective

• To analyze the security mechanisms and communication channels in the Android platform that enable inter-app communication.
• To identify and categorize security vulnerabilities and threats arising from inter-app communication, especially in the context of app collusion.
• To survey existing research and solutions for detecting malicious app collusion.
• To highlight open challenges and limitations in current detection techniques for coordinated app behavior.
• To provide a foundational understanding for future research in securing Android inter-app communication.

Proposed method

• Systematic analysis of Android's inter-app communication mechanisms, including Intents, ContentProviders, BroadcastReceivers, and SharedPreferences.
• Categorization of security threats based on the trust model and access control of each communication channel.
• Survey of existing detection techniques, including static analysis, dynamic taint analysis, and machine learning-based approaches.
• Identification of limitations in current detection methods, such as false positives, scalability issues, and evasion techniques.
• Proposed framework for evaluating detection solutions based on communication channel characteristics and threat models.
• Discussion of architectural and policy-level countermeasures to mitigate collusion risks.

Experimental results

Research questions

• RQ1 What are the primary inter-app communication channels in Android, and how do they introduce security vulnerabilities?
• RQ2 How do malicious apps exploit these channels to perform coordinated attacks through app collusion?
• RQ3 What are the limitations of current detection techniques in identifying colluding apps?
• RQ4 What are the key challenges in designing effective detection mechanisms for inter-app collusion?
• RQ5 How can system-level and application-level security controls be improved to prevent collusion-based threats?

Key findings

• Android's inter-app communication mechanisms, particularly Intents and ContentProviders, are frequently abused by malicious apps to enable collusion.
• App collusion attacks can bypass traditional single-app malware detection due to the lack of cross-app analysis in existing tools.
• Current detection solutions face challenges such as high false positive rates, scalability issues, and difficulty in detecting zero-day collusion patterns.
• Static and dynamic analysis techniques show promise but are often evaded by obfuscation and timing-based collusion strategies.
• There is a lack of standardized evaluation frameworks for collusion detection, limiting reproducibility and comparison of solutions.
• The paper identifies a critical research gap in real-time, scalable, and accurate detection of coordinated app behavior across the Android ecosystem.