# VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics
## 2 Background
### Just-in-Time Memory Forensics (JIT-MF)
Features include whether or not the related work: (i) targets Android OS (Android-inclusive); (ii) addresses acquisition from memory (memory acquisition); (iii) addresses benign app hijack threats, (iv) addresses the ephemerality of evidence in memory by triggering timely memory dumps (triggered dump); (v) works across multiple apps and attack scenarios (extensible); (vi) takes a minimally invasive approach regarding devices (stock devices), (vii) takes a minimally invasive approach regarding apps (stock apps); and (viii) performs anomaly detection (anomaly detection). \begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline
**Feature** & **VEDANDO** & **Forensic Logging** & **Memory Forensics** & **JIT-MF** & **Anomaly Detection** & **Log Reduction** &
\begin{tabular}{c} **Attack** \\ **Investigation** \\ \end{tabular} \\ \cline{2-7}  & & [63, 64, 65, 66, 67, 68] & [69, 70, 71, 72, 73, 74, 75, 76, 77, 78] & [72, 73, 74, 75, 76, 77, 78] & [56, 79] \\ \hline Android inclusive & ✓ & ✓ & ✓ & ✓ & ✗ & ✗ \\ \hline Memory acquisition (R1) & ✓ & ✗ & ✓ & ✓ & ✗ & ✗ \\ \hline Benign app birbick threat & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline Triggered dump (R1) & ✓ & ✗ & ✓ & ✓ & ✗ & ✗ & ✓ \\ \hline Extensible (R2) & ✓ & ✓ & ✓ & ✓ & ✗ & ✗ & ✗ \\ \hline Stock devices (R3) & ✓ & ✓ & ✗ & ✓ & ✗ & ✗ & ✗ \\ \hline Stock apps (R3) & ✓ & ✓ & ✓ & ✗ & ✗ & ✗ & ✗ \\ \hline Anomaly Detection (R4) & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline \hline \end{tabular}

* \(\mathcal{J}\) shows that works in this category have these features, X shows that works in this category \(d\) not have these features. \(*\) shows that some works in this category have these features.

\end{table} 
Table 10: Table showing a comparison of related works, based on features that are novel to this work. ### EDR and Memory Forensics

The use of memory forensics as a source of evidence for EDRs is not novel. Many related works and enterprise tools [63; 64; 65; 66; 67; 68] leverage evidence in memory to help reconstruct attack steps, especially in the case of stealth attacks. Therefore, using memory forensics in Android devices to help reconstruct stealth attack steps is unsurprising. However, in this work, we have proposed a minimally invasive solution that works on stock Android devices and apps and that aims to collect evidence from memory in a timely manner, to address stealth attacks that aim to hide their attack steps. Our work builds on previous research that introduced the JIT-MF framework [21; 23; 24; 25], and demonstrated its ability to log evidence of a benign app hijack attack located in memory and that is not collected from any other forensic source. Previous work evaluated the impact of different trigger point types on the object (evidence) dumped and showed that JIT-MF logs contained critical evidence of app hijack attacks not collected by other state-of-the-art forensic sources. However, the limitations related to app repacking were not addressed, which meant that JIT-MF drivers had to circumvent any anti-repackaging techniques employed by the app. Thus far, the impact of events collected from JIT-MF logs has not been shown. The experimental results in this paper showed that collecting evidence of benign app hijack attacks from memory is possible through JIT-MF and is made feasible through a JIT-MF-enhanced EDR using infrastructure-based JIT-MF drivers. Furthermore, we showed that the logs produced by such an EDR allow for detecting anomalous behavior not found in other forensic sources and that this is the foundation for building the complete attack steps. ### Anomaly Detection for Security

We note that the use of anomaly detection to detect malware has been presented in various works. Such works focused on detecting anomalous behavior in logs [69; 70; 71] and tackle problems related to feature selection, automatic parsing of different, high-volume logs, and finding appropriate anomaly detection methods. However, the premise of such work is that the log events on which anomaly detection models operate include events that indicate abnormal usage.