# VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics
## 2 Background
### Just-in-Time Memory Forensics (JIT-MF)
For example, it hooks ClassLoader to load plugin apps' DEX files and the inter-application communication (IPC) to manage and maintain the lifecycle of the plugin apps' components (such as starting and stopping app activity). While implementations for Android app-level virtualization exist, this technique is still in its infancy, and its feasibility in an enterprise setting may vary between different implementations. ### Anomaly Detection

Anomaly detection techniques are commonly used in automated log analysis [42; 43; 44], especially when dealing with high volumes of logs from different sources. During incident response, such techniques enable investigators and SOC analysts responding to incidents to detect anomalous behavior in systems by using machine learning algorithms to identify uncommon events or observations that raise suspicion, due to them differing significantly from the majority of events. Analysts select feature and time-based parameters within individual log entries that allow anomaly detection techniques to distinguish between log entries resulting from normal behavior and those resulting from potentially malicious, anomalous behavior. In cases where the content of log entries is verbose enough to include keywords that can serve as feature parameters, basic features can suffice to classify anomalies. However, in cases where the logs reflect normal behavior, derived features such as the frequency of the event may be more indicative of anomalous behavior. For instance, in the case of a messaging app hijack attack, features related to the contact name, message content, or the event itself may not be distinct enough to be considered anomalous (in the case of known contacts), given that this is the typical behavior of messaging apps. On the other hand, statistical or derived features related to an abnormal amount of messages may be more indicative of an anomaly. For instance, if the number of logs at a time is a time-based attribute, whereby if this value significantly differs (too high or too low) for a specific time data point, the data point is detected as possibly being anomalous. While selecting features is critical to the success of anomaly detection techniques, this still relies heavily on the content of the logs on which the anomaly detector operates and the known expected app behavior. ## Motivation

### Motivating Example

An employee, [PERSON], received a message on his company phone claiming his parcel had arrived and that he could track it by clicking the link. When he clicked the link, nothing happened, and he assumed the link was wrong. The link silently downloaded a malicious app that abused accessibility services intended to allow apps to interact with app GUIs

Figure 2: App-level virtualization architecture with a container app managing the runtime of plugin apps in different processes but sharing the same unique User ID (UID). on behalf of users, to grant access to a single permission so that the malicious app could hijack instant messaging (IM) apps installed on [PERSON]'s phone. The malware then propagated itself to all of [PERSON]'s contacts by hijacking the default messaging app's functionality to send the messages containing the malware link to [PERSON]'s contacts. It maintained stealth by automatically deleting the sent messages from [PERSON]'s app and hiding its icon from the home screen, so that it was no longer visible to [PERSON]. A day later, [PERSON] received a text from his friend saying he had received a strange message from [PERSON]. [PERSON] did not see a copy of this message on his app and saw no new suspicious apps installed. However, he decided to alert the SOC at his company, which handled the incident response. [PERSON]'s company demand that their employees have an EDR tool deployed on their phones that facilitates detection and response to attacks and onboarding of forensic sources on their enterprise SIEM (security incident event management, for example [45]) software technology (e.g., Splunk).