# VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics
## 2 Background
### Just-in-Time Memory Forensics (JIT-MF)
Available online: [[https://www.crowdstrike.com/cybersecurity-101/endpoint-security/endpoint-detection-and-response-edr/](https://www.crowdstrike.com/cybersecurity-101/endpoint-security/endpoint-detection-and-response-edr/)]([https://www.crowdstrike.com/cybersecurity-101/endpoint-security/endpoint-detection-and-response-edr/](https://www.crowdstrike.com/cybersecurity-101/endpoint-security/endpoint-detection-and-response-edr/)) (accessed on 2 March 2023). * [PERSON] et al. [2020] [PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON] Real-time triggering of Android memory dumps for stealthy attack investigation. In Proceedings of the NordSec, Virtual Event, 23-24 November 2020; pp. 20-36. * [PERSON] et al. [2021] [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON] Responding to Living-Off-the-Land Tactics using Just-In-Time Memory Forensics (JIT-MF) for Android. In Proceedings of the SECRYPT, Lieusant, Paris, 6-8 July 2021; pp. 356-369. * [PERSON] et al. [2023] [PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON] Using infrastructure-based agents to enhance forensic logging of third-party applications. In Proceedings of the ICISSP, Lisbon, Portugal, 22-24 February 2023. * AppBrain [2022] AppBrain: Monetize, Advertise and Analyze Android Apps. 2022. Available online: [[https://www.appbrain.com/stats/libraries](https://www.appbrain.com/stats/libraries)]([https://www.appbrain.com/stats/libraries](https://www.appbrain.com/stats/libraries)) (accessed on 23 August 2022). * [PERSON] et al. [2021] [PERSON]; [PERSON]; [PERSON] [PERSON] ReLF: Scalable Remote Live Forensics for Android. In Proceedings of the 2021 IEEE 20 th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), Shenyang, China, 20-22 October 2021; IEEE: Piscataway, NJ, USA, 2021; pp. 822-831. * [PERSON] et al. [2011] [PERSON]; [PERSON]; [PERSON] SystemSens: A tool for monitoring usage in smartphone research deployments. In Proceedings of the Sixth International Workshop on MobiArch, Bethesda, MD, USA, 28 June 2011; pp. 25-30. * [PERSON] [2013] [PERSON] Android forensics: Automated data collection and reporting from a mobile device. _Digit. Investig._**2013**, _10_, S12-S20. [CrossRef]
* [PERSON] et al. [2013] [PERSON]; [PERSON]; [PERSON] Device analyzer: Understanding smartphone usage. In Proceedings of the Mobile and Ubiquitous Systems: Computing, Networking, and Services: 10 th International Conference, MOBIQUITOUS 2013, Tokyo, Japan, 2-4 December 2013; Revised Selected Papers 10; Springer: Berlin/Heidelberg, Germany, 2014; pp. 195-208. * [PERSON] et al. [2015] [PERSON]; [PERSON]; [PERSON] AFLogical OSE: Open Source Android Forensics App and Framework. 2015. Available online: [[https://github.com/nowsecure/android-forensics](https://github.com/nowsecure/android-forensics)]([https://github.com/nowsecure/android-forensics](https://github.com/nowsecure/android-forensics)) (accessed on 18 February 2023). * [PERSON] et al. [2017] [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON] Delta: Data extraction and logging tool for android. _IEEE Trans. Mob. Comput._**2017**, _17_, 1289-1302. [CrossRef]
* [PERSON] [2023] [PERSON] Andriller-Android Forensic Tools. Available online: [[https://github.com/den4](https://github.com/den4) uklandriller]([https://github.com/den4](https://github.com/den4) uklandriller) (accessed on 18 February 2023). * [34] [PERSON] [PERSON]; [PERSON] [PERSON] An automated timeline reconstruction approach for digital forensic investigations. _Digit. Investigig._**2012**, \(9\), 569-S79. [CrossRef]
* [35] [PERSON] [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON]; [PERSON] A complete formalized knowledge representation model for advanced digital forensics timeline analysis. _Digit. Investigig._**2014**, _11_, S95-S105. [CrossRef]
* [36] [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON]; [PERSON] [PERSON] Automatic Timeline Construction and Analysis for Computer Forensics Purposes. In Proceedings of the 2014 IEEE Joint Intelligence and Security Informatics Conference, The Hague, The Netherlands, 24-26 September 2014; pp.