# Malware Analysis in IoT & Android Systems with Defensive Mechanism
## 6 Application Hardening Technique  
Vulnerabilities of some sort always remain with in the system, and developers are unaware of this. As a result, the application-hardening technique [14; 38; 39] offers a viable alternative. There are multiple methods for accomplishing this, and some of the existing solutions are discussed below. Data Execution Prevention (DEP): DEP is host-dependent system-level memory protection technology that is used to protect against malicious code and injection attacks. This feature designates certain memory locations as protected areas, where no code is performed. If an application attempts to execute code in those protected areas, DEP raises an exception as a memory access violation. Both hardware and software can be used to implement DEP. The hardware-based implementation is performed at the processor level. Address Space Layout Randomization (ASLR) improves security by limiting resource access and preventing current weaknesses from being exploited. During the booting process of some operating systems, engineers fix the original and starting addresses of each segment. Certificate and Public key Pinning (CPP) refers to pinning an X509 certificate and its public key to a root. This aids in the establishment of trust between the sender and the receiver, as well as ensuring the integrity of the website following the verification of a valid certificate and removing harmful targets that break the pinning rules. Null Page Protection is a valid address that refers to storage locations that are currently empty. Null page protection enables PAGE GUARD on a specific location and reallocates virtual memory at 0X0000000 to address such issues. Heap Spray Protection is an attack in which malicious code populates a heap, causing any memory vulnerabilities to be diverted to malicious code. Heap spray prevention aims to reduce the number of heap spray attacks. Regarding CPU-enhanced application security, modern processors have isolated instruction-level execution and run-time memory allocation to address these difficulties. Some of the processors' enhanced security features in modern processors include the Virtual Machine, VT-X/AMD-V, ARM Trust Zone, and Intel SGX. In Virtual Secure Mode (VSM), a spume develops above the hypervisor, and this spume acts as an isolated operating system, tagging connected memory spots and specific programs. Hypervisor code and the kernel mode for integrity and \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Tool**} & \multicolumn{3}{c}{**Efficiency**} & \multicolumn{3}{c}{**Feature and Technique Applied for Vulnerability and Malware Analysis**} \\ \cline{2-5}  & **Accuracy** & **Precision** & **Recall** & \\ \hline NSDroid & 95\% & 96\% & 95\% & The similarity between Application, Function call graph, RF, SVM, Decision Tree \\ TinyDroid & 95 & 92 & 95 & Disassembled application using smali code, Naive Bayes, RF, SVM, kNN \\ DroidSieve & 99 & 99 & 99 & Static analysis, synthetic features used, SVM, Extrac Tree, XGBoost, RF \\ [PERSON] et al. [25] & 94 & - & - & API call and Permission, Source code analysis, RF, SVM, Neural Network \\ DroidAPI Miner & 99 & - & - & Permission and API call, SVM, KNN, C4.5, ID3 \\ DroidMat & 97 & 96 & 87 & Clustering, Activity service and receiver component, Singular value decomposition, K-Means, KNN \\ DroidRanger & - & - & - & Behavioral footprint, Permission \\ [PERSON] et al. [26] & - & - & 80 & Attribute risk level, permission, SVM \\ [PERSON] et al. [28] & 93 & 91 & 96 & System call trace, LSTM, SVM, KNN, Random Forest \\ RepassDroid (Dynamic) & 97 & 99 & 96 & API call and semantic information, Decision Tree, SVM. KNN \\ EnDroid (Dynamic) & 97 & 95 & 97 & System call input output, Decision Tree, Stochastic Descent \\ [PERSON] et al. [29] & - & 95 & 95 & Runtime monitoring, Random Forest, Naive Forest \\ (Dynamic) & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Recapitulative table, where RF stands for Random Fo22 rest, and Dynamic tool is prescribed by the keyword Dynamic.