Please use this identifier to cite or link to this item:
Title: VEDRANDO : a novel way to reveal stealthy attack steps on android through memory forensics
Authors: Bellizzi, Jennifer
Losiouk, Eleonora
Conti, Mauro
Colombo, Christian
Vella, Mark
Keywords: Remote sensing
Computer networks -- Security measures
Mobile computing -- Security measures
Mobile communication systems -- Security measures
Issue Date: 2023
Publisher: MDPI AG
Citation: Bellizzi, J., Losiouk, E., Conti, M., Colombo, C., & Vella, M. (2023). VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics. Journal of Cybersecurity and Privacy, 3(3), 364-395.
Abstract: The ubiquity of Android smartphones makes them targets of sophisticated malware, which maintain long-term stealth, particularly by offloading attack steps to benign apps. Such malware leaves little to no trace in logs, and the attack steps become difficult to discern from benign app functionality. Endpoint detection and response (EDR) systems provide live forensic capabilities that enable anomaly detection techniques to detect anomalous behavior in application logs after an app hijack. However, this presents a challenge, as state-of-the-art EDRs rely on device and third-party application logs, which may not include evidence of attack steps, thus prohibiting anomaly detection techniques from exposing anomalous behavior. While, theoretically, all the evidence resides in volatile memory, its ephemerality necessitates timely collection, and its extraction requires device rooting or app repackaging. We present VEDRANDO, an enhanced EDR for Android that accomplishes (i) the challenge of timely collection of volatile memory artefacts and (ii) the detection of a class of stealthy attacks that hijack benign applications. VEDRANDO leverages memory forensics and app virtualization techniques to collect timely evidence from memory, which allows uncovering attack steps currently uncollected by the state-of-the-art EDRs. The results showed that, with less than 5% CPU overhead compared to normal usage, VEDRANDO could uniquely collect and fully reconstruct the stealthy attack steps of ten realistic messaging hijack attacks using standard anomaly detection techniques, without requiring device or app modification.
Appears in Collections:Scholarly Works - FacICTCS

Files in This Item:
File Description SizeFormat 
VEDRANDO.pdf1.08 MBAdobe PDFView/Open

Items in OAR@UM are protected by copyright, with all rights reserved, unless otherwise indicated.