# VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics
## 2 Background
### Just-in-Time Memory Forensics (JIT-MF)
\begin{table}
\begin{tabular}{c l c c c c} \hline \hline
**Model** & **Model Description** & \multicolumn{4}{c}{**Threshold (Anomaly Probability)**} \\  & **0.95** & **0.90** & **0.85** & **0.80** \\ \hline M1 & ARIMA\_PLUS using Standard Scaler & 70.70\% & 73.08\% & 82.60\% & 82.60\% \\ \hline M2 & ARIMA\_PLUS using Min Max Scaler & 67.96\% & 72.50\% & 82.17\% & 82.17\% \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Table showing the average F1-scores for the reconstructed attack steps across all case studies, generated by the combined anomaly detection and correlation algorithm when using ARIMA_PLUS models, with varying threshold values. The threshold values in this case are inversely proportional to the allowance for anomaly probability. \begin{table}
\begin{tabular}{c l c c c c c} \hline \hline
**Model** & **Model Description** & \multicolumn{4}{c}{**Threshold (Contamination)**} \\  & **0.1** & **0.2** & **0.3** & **0.4** & **0.5** \\ \hline M3 & K-means Grouped at 30 s & 34.74\% & 51.19\% & 65.34\% & 68.09\% & 72.16\% \\ \hline M4 & PCA Grouped at 30 s & 14.60\% & 57.55\% & 65.94\% & 77.61\% & 80.69\% \\ \hline M5 & Autoencoder Grouped at 30 s & 34.74\% & 51.19\% & 65.34\% & 68.42\% & 72.16\% \\ \hline M6 & K-means Grouped at 60 s & 32.60\% & 50.85\% & 70.68\% & 69.95\% & 76.90\% \\ \hline M7 & PCA Grouped at 60 s & 17.35\% & 60.23\% & 78.99\% & 77.55\% & 83.53\% \\ \hline M8 & Autoencoder Grouped at 60 s & 32.60\% & 50.85\% & 70.68\% & 70.09\% & 76.90\% \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Table showing the average F1-scores for the reconstructed attack steps across all case studies generated by the combined anomaly detection and correlation algorithm when using K-means, PCA, and Autoencoder models, with varying threshold values. The threshold values, in this case, are proportional to the allowance for anomaly probability. standard scaler-M1) resulted in an F1-score of 80% and had 100% recall value; that is, full attack step reconstruction. Further analysis of the results obtained by these three models revealed that the average recall value across apps increased at a faster rate than the precision value decreased. This was because, for individual case studies (which varied depending on the model used), a more lenient threshold value was required to obtain the same recall value that the other apps obtained with less lenient threshold values. Figure 8 shows this for the specific case of the model input parameter resulting in the best overall F1-score value (M7). In this case, 90% of the apps used in the case studies reached an average 100% recall value on the reconstructed set of attack steps when the threshold was set to 0.3. However, the WhatsApp Business attack steps were only detected as anomalies when the threshold was set to 0.5. Given that the detection algorithm resulted in high F1-scores when using both PCA models, we concluded that, overall, PCA worked well with the features selected to detect anomalies in JIT-MF logs. Crucially, by using PCA (an existing anomaly detection algorithm available to SOC analysts) with a 0.5 threshold, and using the set of features described in Table 5 and correlation settings defined in Section 5.3.2, the detection algorithm used by VEDRANDO could fully reconstruct the attack steps of benign app hijack attacks with a relatively high precision across all case studies based on evidence collected from JIT-MF logs. We also evaluated the sensitivity of our detection and correlation algorithm to the threshold value given as a parameter using a Wilcoxon signed rank test ([[https://en.wikipedia.org/wiki/[PERSON]_signed-rank_test](https://en.wikipedia.org/wiki/[PERSON]_signed-rank_test)]([https://en.wikipedia.org/wiki/[PERSON]_signed-rank_test](https://en.wikipedia.org/wiki/Wilcoxon_signed-rank_test))). The results showed that the change-in-value of the F1-scores between the threshold values for K-Means, PCA, and Autoencoder were statistically significant. Therefore, when using such models, the algorithm is considered sensitive to the threshold set.