Trusted Execution Environments (TEEs) are a feature of modern central processing units (CPUs) that aim to provide a high assurance, isolated environment in which to run workloads that demand both confidentiality and integrity. Hardware and software components in the CPU isolate workloads, commonly referred to as Trusted Applications (TAs), from the main operating system (OS). This article aims to analyse the TEE ecosystem, determine its usability, and suggest improvements where necessary to make adoption easier. To better understand TEE usage, we gathered academic and practical examples from a total of 223 references. We summarise the literature and provide a publication timeline, along with insights into the evolution of TEE research and deployment. We categorise TAs into major groups and analyse the tools available to developers. Lastly, we evaluate trusted container projects, test performance, and identify the requirements for migrating applications inside them.

With the emergence of Android malware and be-havioral polymorphism, it has been increasingly popular to use advanced machine learning and deep learning approaches for malware detection. Despite the fact that such classifiers have proven accurate in real-life settings, they remain uninterpretable and difficult for analysts and users to comprehend how they arrive at their classification decisions. Considering that the exfiltration of sensitive information is one of the most significant security threats, we examined both monograms and trigrams of system calls for normal and malicious software and received higher detection accuracy by using the trigram dataset. Based on this, we propose an auxiliary architecture for model explainability of complex data features via enhancement and aggregation of the auxiliary model with the main model based on the degree of disagreement between the two models. In this study, we employ the SHAP (Shapley Additive Explanations) framework to interpret the random forest models in order to identify the features most influential in predicting the model's predictions, along with quantifying their contributions to individual predictions. The obtained results confirm that the models are not biased and the features that influence the classification prediction are intuitive in terms of the exfiltration problem in question. In addition, our proposed methodology increases transparency and interpretability of our exfiltration detection model running in production, increasing the users' trust in the model's predictions.