Detecting Android App Collusion: A Comparative Study of Dynamic Analysis and Machine Learning Approaches

The paper reviews the detection of app collusion in Android, where the menace involves two or more apps working together to circumvent the permission-based security model of the system. Simple security tools, which consider operating alone, would thus miss identifying such coordinated acts of malice. The paper discusses dynamic analysis and machine learning (ML) techniques as potent candidates for the detection of app collusion. Among dynamic analysis techniques, inter-app communication monitoring, runtime taint tracking, and sensor signal analysis are elaborated for their capability to acquire system metadata in real-time and detect overt and covert channels of collusion. The paper presents an overview of machine-learning techniques that rely upon features based on permission sets, communication graphs, and behavioral logs for detection, with some techniques reporting an accuracy of up to 97.5%. This analysis of different approaches will enable their capabilities and limitations to be distinguished so that the potentiality of hybrid approaches that extend dynamic analysis by ML is highlighted. The review also states open challenges, such potential problems as the scarcity of data, resource efficiency, and adaptive attacks, as well as explaining AI, and future research proposals to improve Android app collusion detection.