Mobile App Security Assessment with the MAVeriC Dynamic Analysis Module

Armando, Alessandro; Bocci, Gianluca; Costa, Gabriele; Mammoliti, R.; Merlo, Alessio; Ranise, Silvio; Traverso, Riccarto; Valenza, Andrea

doi:10.1145/2808783.2808786

Cited by 4 publications

(3 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Bayesian classification tools which reverse engineering are discussed in [37] also played important role in android-based malware detection techniques. Static Analysis Module (SAM) is developed by Armando et al (2014) [38]. Static analysis, often known as unit testing, is a technique for troubleshooting software programs that involves looking at the source before actually running the programme.…”

Section: Static Analysismentioning

confidence: 99%

Deep Learning Based Hybrid Analysis of Malware Detection and Classification: A Recent Review

Hussain,

Razak,

Firdaus

2023

JCSANDM

View full text Add to dashboard Cite

Globally extensive digital revolutions involved with every process related to human progress can easily create the critical issues in security aspects. This is promoted due to the important factors like financial crises and geographical connectivity in worse condition of the nations. By this fact, the authors are well motivated to present a precise literature on malware detection with deep learning approach. In this literature, the basic overview includes the nature of nature of malware detection i.e., static, dynamic, and hybrid approach. Another major component of this articles is the investigation of the backgrounds from recently published and highly cited state-of-the-arts on malware detection, prevention and prediction with deep learning frameworks. The technologies engaged in providing solutions are utilized from AI based frameworks like machine learning, deep learning, and hybrid frameworks. The main motivations to produce this article is to portrait clear pictures of the option challenging issues and corresponding solution for developing robust malware-free devices. In the lack of a robust malware-free devices, highly growing geographical and financial disputes at wide globes can be extensively provoked by malicious groups. Therefore, exceptionally high demand of the malware detection devices requires a very strong recommendation to ensure the security of a nation. In terms preventing and recovery, Zero-day threats can be handled by recent methodology used in deep learning. In the conclusion, we also explored and investigated the future patterns of malware and how deals with in upcoming years. Such review may extend towards the development of IoT based applications used many fields such as medical devices, home appliances, academic systems.

show abstract

Section: Static Analysismentioning

confidence: 99%

Deep Learning Based Hybrid Analysis of Malware Detection and Classification: A Recent Review

Hussain,

Razak,

Firdaus

2023

JCSANDM

View full text Add to dashboard Cite

show abstract

“…The MAVeriC [6], [5] platform integrates a static and analysis environment for Android applications. The dynamic analysis consists of a TEE that randomly stimulates the AUT in order to trigger some illegal behavior.…”

Section: Related Workmentioning

confidence: 99%

“…Moreover, all exploit test cases are returned in a few minutes. We also ran OWASP ZAP 5 , w3af 6 and Vega 7 , three popular state-of-the-art web scanners, against SCW and WackoPicko They were unable to detect most of the vulnerabilities found by Beagle.…”

Section: Introductionmentioning

confidence: 99%

Why Charles Can Pen-test: an Evolutionary Approach to Vulnerability Testing

Costa,

Valenza

2020

Preprint

Self Cite

View full text Add to dashboard Cite

Discovering vulnerabilities in applications of realworld complexity is a daunting task: a vulnerability may affect a single line of code, and yet it compromises the security of the entire application. Even worse, vulnerabilities may manifest only in exceptional circumstances that do not occur in the normal operation of the application. It is widely recognized that stateof-the-art penetration testing tools play a crucial role, and are routinely used, to dig up vulnerabilities. Yet penetration testing is still primarily a human-driven activity, and its effectiveness still depends on the skills and ingenuity of the security analyst driving the tool. In this paper, we propose a technique for the automatic discovery of vulnerabilities in event-based systems, such as web and mobile applications. Our approach is based on a collaborative, co-evolutionary and contract-driven search strategy that iteratively (i) executes a pool of test cases, (ii) identifies the most promising ones and (iii) generates new test cases from them. The approach makes a synergistic combination of evolutionary algorithms where several "species" contribute to solving the problem: one species, the test species, evolves to find the target test case, i.e., the set of instruction whose execution lead to the vulnerable statement, whereas the other species, called contract species, evolve to select the parameters for the procedure calls needed to trigger the vulnerability. To assess the effectiveness of our approach, we implemented a working prototype and ran it against both a case study and a benchmark web application. The experimental results confirm that our tool automatically discovers and executes a number of injection flaw attacks that are out of reach for stateof-the-art web scanners.

show abstract