Feature Analysis and Classification of Collusive Android App-Pairs Using DBSCAN Clustering Algorithm

In this study, we tackle the issue of application collusion, which involves multiple apps working together to achieve malicious goals that they couldn’t achieve individually. The current security model of Android, which focuses on permissions, doesn’t effectively address this threat because it only mitigates risks associated with individual apps. To address this limitation, we carried out an extensive analysis of features to identify the key Android permissions utilized by colluding app-pairs. We propose an approach to classify collusive app-pairs using the DBSCAN clustering algorithm. Our results provide valuable insights into the relationship between specific Android permission sets and the malicious activities performed by colluding app-pairs. We identified 12 permissions as the most important features contributing to the classification of collusive app-pairs. We also identified 4 distinct clusters of colluding Android app-pairs.