App Collusion Detection (ACID)

Malware has been a major problem in desktop computing for decades. With the recent trend towards mobile computing, malware is moving rapidly to smartphone apps. Our business partner McAfee alone collected 17,000 Android malware samples in the most recent quarter, double the rate of the previous year. Criminals are clearly motivated by the opportunity - about one billion smartphones will be sold in 2013, predominantly Android, with more than 10 billion apps downloaded to date.

Smartphones pose a particular security risk because they hold personal details (accounts, locations, contacts, photos) and have potential capabilities for eavesdropping (with cameras/microphone, wireless connections). By design, Android is "open" in its flexibility to download apps from different sources. Its security depends on restricting apps by combining digital signatures, sandboxing, and permissions.

Unfortunately, these restrictions can be bypassed, without the user noticing, by colluding apps whose combined permissions allow them to carry out attacks that neither app can accomplish by itself. A basic example of collusion consists of one app permitted to access personal data, which passes the data to a second app allowed to transmit data over the network. While collusion is not a widespread threat today, it opens an avenue to circumvent Android permission restrictions that could be easily exploited by criminals to become a serious threat in the near future.

The UK Cyber Security Strategy notes that UK industry, as well as the public, needs to have confidence in a safe cyber space. Emerging privacy threats to smartphones are particularly timely to address considering the current controversies about US government data collection and monitoring of private communications. Sensitive data leakage is the main security risk posed by colluding apps, and the proposed project will help maintain users' confidence in smartphone privacy.

Currently almost all academic and industry efforts are focusing on detection of single malicious apps. Almost no attention has been given to colluding apps. The threat has been demonstrated only recently. The threat of colluding apps is challenging to detect because of the myriad and possibly stealthy ways in which apps might communicate and collude. Existing antivirus products are not designed to detect collusion. Preliminary research in the literature has not found any reliable means to detect collusion.

This project directly addresses the aims of the BACCHUS call by building an important collaboration between McAfee and academic experts in network security, intrusion detection, and formal methods to develop innovative methods for collusion detection. Our industry partner McAfee is a global leading security company with extensive facilities for monitoring, collecting, and analyzing smartphone threats.

This project aims to develop novel theoretical and practical methods to detect apps suspected of collusion and perform formal safety checking. The resulting methods will be deployed and tested by the industry partner, McAfee Labs, in their global Threat Intelligence System. If successful, the research project will help to proactively defend smart phones against the emerging threat of colluding apps. McAfee products are some of the most popular with the consumers in the UK, providing day-to-day guarding against PC and mobile threats.

Success in this project would mean a rare opportunity for the cyber security community to stay ahead of an emerging threat instead of reacting to a threat already prevalent.

ACID aims to develop new techniques for detecting the emerging threat of colluding apps. Success of this project will curtail the threat before it becomes widespread in the wild. This would have broad benefits to researchers (as discussed in Academic Beneficiaries), security and telecommunications industries, and society in general. The beneficiaries are discussed separately below.

McAfee - Our industry partner will be a beneficiary by gaining new knowledge from the research collaboration and exploiting the research results in their commercial systems. As a global leader in the cyber security field, McAfee has vast resources for monitoring, collecting, and analyzing mobile and desktop malware. However their systems are not configured to detect colluding apps because the threat has become known only recently. Through this collaboration, McAfee will gain a new understanding of the collusion threat and will be able to enhance the capabilities of their threat management system.

Cyber security industry - The broader cyber security industry will benefit through the publications of the research team and dissemination through all the channels described in the Pathways to Impact. Virtually all antivirus products and research are currently focused on detection of single malicious apps. The results of this project will help to improve the capabilities of all antivirus products.

Telecommunications industry - Most smartphones sold today are Android, and malware is a rapidly growing problem for Android, eroding public confidence. Without this project, criminals might turn colluding apps into a widespread threat in the near future. This project will help maintain confidence in smartphones which is now the most common way to connect to the Internet for many users.

Society - This project will have a number of benefits on society such as:
(i) By curtailing the Android malware problem, the project helps to maintain public confidence in using their smartphones and the Internet in general.
(ii) Public confidence will lead to continuation of a robust smartphone industry, an important component of the digital economy.
(iii) The new knowledge derived from the project will enhance the skills and knowledgebase of researchers and students.

UK Government - The government has publicly pronounced cyber security as a top national priority. The results of this project will address national issues of concern and could influence public polices related to best practices to secure mobile devices.