Android devices continue to dominate the mobile device market. However, ever-increasing reverse engineering capabilities and the ability to repackage apps to include malicious code with relative ease introduce significant challenges for marketplace providers. This research investigates the idea that system stats generated from running apps can be utilized to identify apps. The stats are collected from the host system while apps are running in an Android Virtual Device environment. The dataset comprises 998 repackaged apps, 1,533 malicious apps, and 2,130 normal apps. The results were analyzed using a J48 decision tree and achieved 99% accuracy.

International audience

With the increased assimilation of technology into all aspects of everyday life, rootkits pose a credible threat to individuals, corporations, and governments. Using various techniques, rootkits can infect systems and remain undetected for extended periods of time. This threat necessitates the careful consideration of real-time detection solutions. Behavioral detection techniques allow for the identification of rootkits with no previously recorded signatures. This research examines a variety of machine learning algorithms, including Nearest Neighbor, Decision Trees, Neural Networks, and Support Vector Machines, and proposes a behavioral detection method based on low yield CPU power consumption. The method is evaluated on Windows 7, Windows 10, Ubuntu Desktop, and Ubuntu Server operating systems along with employing four different rootkits. Relevant features within the data are calculated and the overall best performing algorithms are identified. A nested neural network is then applied that enables highly accurate data classification. Our results present a viable method of rootkit detection that can operate in real-time with minimal computational and space complexity.

Security for Cyber physical systems includes not only guaranteeing operational security of data they process, but preventing malicious alteration of their execution due to knowledge of their underlying structure. With the advent of software in the form of reprogrammable hardware descriptions, protection of field programmable units from malicious reverse engineering and subversion becomes more critical. We compare four different white-box transformation algorithms aimed at hindering adversarial reverse engineering by changing component and signal configurations within combinational logic programs. We present security and efficiency analysis for these techniques and show positive results for achieving measurable hiding of signal and component information.

Field programmable gate arrays (FPGAs) have become increasingly popular in circuit development due to their rapid development times and low costs. With their increased use, the need to protect their intellectual property (IP) becomes more urgent. The digital fingerprint accomplishes this by creating a unique identification (ID) for each FPGA. In this research, we propose methods to dramatically increase the stability and robustness of the digital fingerprint ID by the proper choice of input sequences. We also show that by properly choosing the input word, we can significantly increase the DF resistance to operating temperature changes.

The susceptibility of digital systems to tampering is of immense concern to military and commercial organizations. Current defenses against such techniques as reverse engineering and side channel analysis are limited and don't address the underlying vulnerable characteristics of digital circuits. In this paper, we propose a generalized defense methodology named dynamic polymorphic reconfiguration that significantly reduces the probability of successful tampering. We achieve protection through targeted component hiding and the introduction of run-time autonomous defense adaptations. As a result, we establish the feasibility of self-protecting circuits.

In this paper, we discuss the method of creating a circuit identifier, or digital fingerprint, for field programmable gate arrays (FPGAs). The proposed digital fingerprint is a function of the natural variations in the semiconductor manufacturing process that cannot be duplicated or forged. The proposed digital fingerprint allows the use of any arbitrary of nodes internal to the circuit or the circuit outputs as monitoring locations. Changes in the signal on a selected node or output can be quantified digitally over a period of time or at a specific instance of time. Two monitoring methods are proposed, one using cumulative observation of the nodes and the other samples the nodes based on a signal transition. Two monitoring methods were validated on a small sample of twenty XilinxregVirtex-II Pro FPGAs, where both methods successfully created unique identifiers for each FPGA. In addition, the effects of temperature and voltage fluctuations are also discussed.

The de facto standard program obfuscation security model, termed the virtual black box (VBB), declares a program to be securely obfuscated if and only if an adversary can prove no more when given the obfuscated code than it can when only given oracle access to the original program. In this paper, we define and give methodology for a perfectly secure program intent obfuscation that is general and practical for bounded input-size programs, including those with input/output relationships that are easily learned. We also lay foundations for how to embed a key securely in a private-key encryption setting using such constructions