# VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics
## 2 Background
### Just-in-Time Memory Forensics (JIT-MF)
This, however, may vary depending on the type of JIT-MF driver used in the VirtualApp container. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & \multicolumn{2}{c}{**VirtualApp**} & \multicolumn{2}{c}{**VirtualApp with JIT-MF**} \\  & & _(Added pp Overheads on Device)_ & _(Added pp Overheads on Plain VirtualApp)_ \\ \hline \multirow{3}{*}{VEDRANDO’s} & min. & \(-0.46\) & \(+1.2\) \\  & avg. & \(+2.83\) & \(+2.06\) \\  & max. & \(+2.76\) & \(+6.79\) \\ \hline \multirow{3}{*}{VEDRANDO’s} & min. & \(-0.48\) & \(+0.23\) \\  & avg. & \(+0.56\) & \(+0.18\) \\ \cline{1-1}  & max. & \(+1.19\) & \(+0.29\) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Overall CPU and memory usage overheads in percentage points (pp) for the 28 most popular apps, when executed within VirtualApp and a JIT-MF-enhanced version of VirtualApp, respectively. ### Attack Investigation Case Studies

We evaluated the effectiveness of VEDRANDO's attack detector by measuring its ability to reveal attack steps related to stealthy benign app hijack attacks in a realistic scenario. Rather than assessing the performance of existing anomaly detection models on a large dataset, we aimed to demonstrate how the anomaly detection methods typically available to SOC analysts through their SIEM setup can be used to detect anomalous events related to benign app hijack attacks when provided with JIT-MF logs produced by VEDRANDO's events collector component. To this end, similarly to other related works [54, 55, 56], we presented a qualitative case study for a benign instant messaging (IM) hijack attack targeting Android's ten most popular IM apps, as shown in Table 3, following the threat model described in Section 3.2. In Sections 5.3.1 and 5.3.2, we describe the case study setup and the settings used for the proposed anomaly detection and correlation algorithm (Algorithm 1), respectively. Section 5.3.3 shows the summarized results concerning the reconstructed attack steps obtained for the ten case studies. #### 5.3.1 Case Study Setup

Figure 7 shows the experiment setup and flow, comprising an implementation of the working prototype for VEDRANDO, shown previously in Figure 4, and the investigation flow indicated by arrows. A stock (unrooted) Google Pixel 3a physical phone was used, on which an implementation of VEDRANDO's events collector component was deployed, using an SQLite-based JIT-MF driver ([[https://gitlab.com/bellj/vedrando/-/tree/main/sdlite-jitmf-driver.js](https://gitlab.com/bellj/vedrando/-/tree/main/sdlite-jitmf-driver.js)]([https://gitlab.com/bellj/vedrando/-/tree/main/sdlite-jitmf-driver.js](https://gitlab.com/bellj/vedrando/-/tree/main/sdlite-jitmf-driver.js))), given that the popularity of this infrastructure among messaging apps has already been established (see Figure 6a). Normal traffic on each app consisted of loading and sending instant messages. This was simulated using _AndroidViewClient_ ([[https://github.com/dtmilano/AndroidViewClient](https://github.com/dtmilano/AndroidViewClient)]([https://github.com/dtmilano/AndroidViewClient](https://github.com/dtmilano/AndroidViewClient)) accessed on 30 October 2022), assuming that the user messages random contacts from his list of contacts, waiting a random amount of seconds (between one and ten) before sending the message. We acknowledge that this simulation of normal traffic may be a threat to validity. However, we claim that the simulated traffic generated within the case study time window was a sufficiently realistic representation to provide a basis for our study. Table 4 shows the ground truth timeline of events carried out to simulate the attack scenario for this case study. A malicious message is received containing a link to a malicious app (Table 4). Once the user clicks on the link, the app (a fake app called _demo.apk_) is silently installed (Table 4) and propagates to the user's contacts via the default IM app installed (in this case, the apps in Table 3).