# VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics
## 2 Background
### Just-in-Time Memory Forensics (JIT-MF)
#### 5.3.3 Attack Investigation Results

For each targeted app, the ground truth attack steps of the simulated benign app hijack were recorded as shown in Table 7 (a subset of the events shown in Table 4). We demonstrated the value of timely evidence collected from the app memory for each attack by first showing that, upon manual inspection, evidence related to the attack steps was predominantly only collected by VEDRANDO's events collector. Furthermore, based on the detection methodology described in Algorithm 1, we showed in the realistic context of an ongoing investigation that the evidence in JIT-MF logs was critical for detecting and responding to anomalies. Artefacts Recovered by JIT-MF Logs

Table 7 summarizes which critical attack steps executed on all targeted messaging apps were found in logs typically collected by an EDR and in those collected by VEDRANDO's events collector component that included JIT-MF logs. The results showed that VEDRANDO's events collector, using app-level virtualization enhanced with JIT-MF drivers, collected JIT-MF logs comprising evidence from memory from all the apps in the case studies, without requiring app-repackaging. In nine out of the ten case studies carried out (except for the Skype case study), critical attack steps (  and ) were only collected when considering JIT-MF forensic log sources. This evidence was located given knowledge of the ground truth. However, investigators and analysts investigating an attack scenario require a detection methodology that points to these specific events to allow detection of anomalous behavior. Specifically, events  and  were only considered anomalous after having been correlated to events  and, and collected solely by JIT-MF (except for one case study). Reconstruction of Attack Steps

Now that we have established that only JIT-MF uncovered these anomalies, we focus on the thresholds and model parameter selection that performed best with the attack detector to uncover these anomalies. Tables 8 and 9 show the effectiveness of the detection and correlation algorithm in VEDRANDO's attack detector component for reconstructingstealthy attack steps executed during the stealth IM hijack case studies, with the input parameters defined in Section 5.3.2. For each model and threshold input combination, we calculated the average recall, precision, and F1-scores, to measure the overall accuracy of the reconstructed set of events returned by the attack detector when compared to the ground truth set of events executed by the attack. The F1-score combines precision and recall values. Therefore, the higher the F1-Score, the more accurate the list of attack steps returned by VEDRANDO's attack detector. The tables above show the averaged results over all the attack case studies carried out during experimentation. The results demonstrate that, overall, threshold parameter values with greater allowance for anomalies (<0.9 for ARIMA_PLUS and >0.3 for K-means, PCA and Autoencoder models) returned a more accurate reconstruction of the attack steps. Specifically, three models (PCA models M4 and M7, and the ARIMA_PLUS model using a \begin{table}
\begin{tabular}{c l c c c c} \hline \hline
**Event** & **Event Description** & **Collected by** & **Collected by** & **Detected by** & **Detected by** \\  & **by EDR** & **VEDRANDO** & **by EDR** & **VEDRANDO** \\ \hline \multirow{3}{*}{**C**} & Malware entry point & ✓ & ✓ & ✗ & ✓ \\  & Malicious _demo.apk_ installed & ✓ & ✓ & ✗ & ✓ \\ \hline \multirow{3}{*}{**C**} & Link propagated to contacts & ✗\({}^{*}\) & ✓ & ✗ & ✓ \\ \cline{1-1} \cline{2-6}  & Propagated messages & ✗\({}^{*}\) & ✓ & ✗ & ✓ \\ \cline{1-1} \cline{2-6}  & deleted & & & & \\ \hline \hline \end{tabular} \(\mathcal{J}\) refers to _disclosed_ attack steps. ✗ refers to _undisclosed_ attack steps. \(*\) these attack steps were recovered during the Skype case study _only_.

\end{table} 
Table 7: Comparison of the ground truth attack steps disclosed and detected by a typical EDR and by VEDRANDO (columns 3 and 4, 5 and 6), respectively.