# VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics
## 2 Background
### Just-in-Time Memory Forensics (JIT-MF)
At its most native level (see Section 4.1.1), Android architecture components refers to storage management through an SQLite Database ([[https://developer.android.com/training/data-storage/sdlite](https://developer.android.com/training/data-storage/sdlite)]([https://developer.android.com/training/data-storage/sdlite](https://developer.android.com/training/data-storage/sdlite)) accessed on 30 June 2023). While keeping in mind that these values were obtained via static analysis of apps, this still bodes well for the extensibility of JIT-MF drivers and the feasibility of JIT-MF driver development, since one SQLite-based JIT-MF driver could potentially be successful on an extensive range of apps. ### Runtime Evaluation

We evaluated the feasibility of VEDRANDO's events collector VirtualApp and JIT-MF driver setup, in terms of its compatibility with Android apps and the resulting performance overheads. To do this, we selected a set of apps from the 100 most popular apps in Google PlayStore in February 2022 (as listed on AppBrain), which had not previously been installed on the phone and were not manufacturer-specific, resulting in a total of 33 apps. A stock (unrooted) Google Pixel 3a physical phone, with eight processors and 4 GB RAM, was used, which runs on arm64-v8a CPU architecture and Android version 9 (as

Figure 6: Storage and network library adoption by the 550 most popular apps in February 2023 [26]. required by VirtualApp). The apps selected were downloaded from APKPure ([[https://apkpure.com/](https://apkpure.com/)]([https://apkpure.com/](https://apkpure.com/)) accessed on 30 October 2022) using _apkeep_ ([[https://github.com/EFForg/apkeep](https://github.com/EFForg/apkeep)]([https://github.com/EFForg/apkeep](https://github.com/EFForg/apkeep)) accessed on 30 October 2022) to ensure that the APKs downloaded complied with the architecture and Android version. We used the _UI Exerciser Monkey_ tool ([[https://developer.android.com/studio/test/other-testing-tools/monkey](https://developer.android.com/studio/test/other-testing-tools/monkey)]([https://developer.android.com/studio/test/other-testing-tools/monkey](https://developer.android.com/studio/test/other-testing-tools/monkey)) accessed on 30 October 2022) to exercise each app's functionality by injecting 20 random UI events with a throttle of 30 s, which allowed the virtual environment to spawn the app, but which could not be reset to execute the rest of the events due to limitations of _UI Exerciser Monkey_. A seed value was used to ensure that the same app events could be repeated in the case of multiple runs. Results

Table 2 shows the minimum, average, and maximum overhead values expressed in percentage points (pp). In the first column, we compared the execution of apps in a plain VirtualApp with the traditional execution method (no virtualization). We computed the overhead for the VirtualApp container as implemented in VEDRANDO's events collector component (i.e., second column) compared to the execution in a plain VirtualApp environment. Since the execution of an app under virtualization is composed of two processes (the container and plugin), the overall amount of CPU and memory is given by the sum of the overhead of these two processes. The results from Table 2 show that when introducing virtualization through VirtualApp, there was an average increase of 2.83 pp in CPU usage and 0.56 pp in memory usage. The results for the container as implemented in the events collector component, using an SQLite-based JIT-MF driver, show that the additional average overhead introduced was negligible, i.e., an increase of 2.06 pp for the CPU usage and 0.18 pp for the memory. We concluded that this increase was caused by the overhead required by JIT-MF drivers to capture memory dumps for trigger points performed through instrumenting methods. The overall additional CPU usage incurred by VEDRANDO's _events collector_ component when using SQLite-based JIT-MF drivers was on average 4.89 pp, rendering it feasible in terms of runtime performance in a real-world scenario.