# VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics
## 2 Background
### Just-in-Time Memory Forensics (JIT-MF)
In contrast, the K-means, PCA, and Autoencoder models use multiple features for clustering (K-means) and dimensionality reduction (PCA, Autoencoder), which results in the identification of anomalies based on outliers and reconstruction loss. Each model supports a custom threshold for anomaly detection in Google BigQuery ML ([[https://cloud.google.com/blog/products/data-analytics/bigquery-ml-unsupervised-anomaly-detection](https://cloud.google.com/blog/products/data-analytics/bigquery-ml-unsupervised-anomaly-detection)]([https://cloud.google.com/blog/products/data-analytics/bigquery-ml-unsupervised-anomaly-detection](https://cloud.google.com/blog/products/data-analytics/bigquery-ml-unsupervised-anomaly-detection))). For ARIMA_PLUS models anomalies are identified based on the confidence interval for that timestamp. If the probability that the data point at that timestamp occurs outside of the prediction interval exceeds a given probability threshold, the data point is identified as an anomaly. Furthermore, since Google BigQuery returns the feature value, our detection algorithm implementation also checked that, for the given anomaly found, _Feature 1_ (the discrepancy between logs) was greater than 0. For the other models, anomalies were identified based on the value of each input data point's normalized distance to its nearest cluster. The data point was identified as an anomaly if that distance exceeded a threshold determined by the given contamination value. The \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **AD Method** & **Feature** & **Feature Options** \\ \hline M1 & ARIMA\_PLUS & Feature 1 & Standard Scaler \\ \hline M2 & ARIMA\_PLUS & Feature 1 & Min Max Scaler \\ \hline M3 & K-Means & Feature 2–11 & Grouped by 30s \\ \hline M4 & PCA & Feature 2–11 & Grouped by 30s \\ \hline M5 & Autoencoder & Feature 2–11 & Grouped by 30s \\ \hline M6 & K-Means & Feature 2–11 & Grouped by 60s \\ \hline M7 & PCA & Feature 2–11 & Grouped by 60s \\ \hline M8 & Autoencoder & Feature 2–11 & Grouped by 60s \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Models generated based on the selected features. contamination value defined the proportion of anomalies in the training dataset. This value ranged from 0.1 to 0.5, where 0.1 and 0.5 mean that 10% and 50% of the training data used to create the input model, respectively, were anomalous. Whereas for the ARIMA_PLUS models, a lower threshold value made the data points more likely to be considered anomalous, for the other models, a larger contamination value (threshold) made the data points more likely to be considered anomalous. High-Level Event Reconstruction and Correlation

Before executing the attack detector component of VEDRANDO, we conducted a preliminary manual analysis of the logs generated by the SQLite JIT-MF drivers, to determine how low-level JIT-MF log entries could be combined to form more indicative high-level events. This analysis revealed that, in the case of SQLite-based JIT-MF drivers and the apps used in the case studies, a regex pattern for JIT-MF logs generated by each app could identify a log entry that reflected the actions of several JIT-MF low-level events generated after an action had occurred. For instance, when a message is sent (high-level event), multiple JIT-MF log entries (low-level events) are generated (related to updates made to several tables in the database). A single entry, however, is identified as explicitly updating and inserting content into the app's specific messages table in the database. This manual process was also required to select the correlation regex keyword specific to each app. In these case studies, keyword regex aimed to extract the message content and identifier (ID). Therefore, we defined regex string patterns for these two keywords for each app, so that any message content or message ID found in the log entries could be correlated with related events.