A Blockchain-Based Security Analysis Framework for Mobile Applications
Creators: name: OUAGUID, Abdellah
Publisher: name: Zenodo
Year: 2023
Subjects: Android Security
Blockchain
Malware detection approaches
Permission Based Security
Consensus algorithm
CVSS
Distributed system
Reward Approach
Punishment Approach
Trusted Digital Repository
Loyalty Programs

description: The year 2020 saw remarkable domination of Android devices. Android’s large share of the global market (85%) places it first in the list of preferred targets for mobile cybercrime. Computer attacks try to control and access confidential user information by exploiting the various vulnerabilities present in the various components of the Android ecosystem.<br> This thesis aims to propose a new Framework named ANDROSCANREG (Android Permissions Scan Registry) which incorporates an extensible approach for analyzing Android applications initially based on permissions and deployed in a decentralized and distributed system. The mentioned framework is based on the emerging technology called "Blockchain" whose potential is approved for transparency, availability, security, and reliability without resorting to a central trusted entity.<br> Furthermore, in our efforts to improve the implementation of this Framework, we have proposed a new consensus algorithm called "Proof of Conformity -PoC-" in order to improve the reliability of consensus algorithms whose node weight calculation is based on one (or more) distinctive measurable criterion (stake, power, etc.). This improvement relates to the addition of a new impact factor called "Node Security Metric (NSM)" in the calculation of the node weight.<br> NSM is primarily based on the weight recalculation of each network node based on the security and stability of its respective software and hardware environment. PoC weight recalculation is based on Common Vulnerability Scoring System (CVSS) vulnerabilities, our new approach aims to strengthen the node security index and encourage participants, respecting the recommended security requirements, to take advantage of their proactivity, vigilance, and compliance by increasing their chance of being selected as a Leader (validator) and winning rewards corresponding to the effort deployed.<br> Besides, PoC has been theoretically evaluated via simulation scenarios through which significant results have been obtained showing that our approach ensures more likelihood for the more secure participating nodes to be designated as a validator based on their compliance rates represented by their NSM scores.<br> Moreover, we thought as part of our research axis to equitably reward active participants. Indeed, we have presented a new approach for calculating rewards and penalties for systems based on Blockchain technology. The objective of our proposal is to ensure a new source of income in order to retain participants by guaranteeing them permanent profitability in exchange for their active participation in the stability and security of the Blockchain network to which they belong.<br> We have studied and analyzed existing systems that, in general, favor the monopoly of rewards by attributing them either only to the Leader node (elected by a consensus algorithm) or benefit the Leader from a large part of the rewards and distributing the rest to a shortlist of participants. The result of our study shows that our approach offers more benefits by ensuring permanent, dynamic, and proportional rewards for all participating nodes according to their scores and compliance rate, the latter impacts the gradual penalty system put in place, which verifies the compliance of each node to the Blockchain protocol rules.<br> A new innovative concept of operations execution in a Blockchain network was also proposed in this thesis. Indeed, the new approach improves the traditional data validation processes opted by Blockchain-based systems by allowing their nodes to adopt different and modifiable environments at any time in order to reduce the false positive rate and help identify polymorphic treatments and thus improve the reliability of the final results.
description: This thesis is under embargo and not available to share entirely with the public yet, but more information is available upon request.