Since the outbreak of the coronavirus 2019 (COVID-19) pandemic, telehealth services are regarded as a good approach to keep health workers and patients safe while simultaneously managing available resources.In this paper, we discuss the impact that COVID-19 has on telehealth services and on telehealth users' opinion of the service.We collected 245 Android telehealth apps, 144 iOS telehealth apps and 86 telehealth websites, and performed a systematic analysis on this dataset.In this analysis, we conducted a comparison analysis and relevant content analysis of the telehealth apps as well as their security risks.Apart from the mobile platforms, we also inspected the telehealth websites' features, particularly those related to the use of metaverse to improve current telehealth solutions.To further understand people's attitude towards telehealth services, we invited users to participate in a user study aimed at revealing what impact COVID-19 has on users' willingness to adopt telehealth services and revealing the gap between the telehealth service and its users.Our result shows that 27.1% new iOS apps and 27.4% new Android apps were released after the COVID-19 announcement, and a surge of updates were noted within 4 weeks after the COVID-19 announcement.We further found that COVID-19 is frequently mentioned in telehealth app reviews in the second and third quarter of 2020, and the most mentioned aspects related to COVID-19 include family, test result and vaccine.According to our user study, COVID-19 has a significant impact on the selection of telehealth services, especially for female participants, people aged 46-55, and students.The investigation also finds out that the use of metaverse will significantly improves the effectiveness of traditional telehealth solutions.

It is important to understand the evolution of Android malware as this facilitates the development of defence techniques by proactively capturing malware features. So far, researchers mainly rely on dendrogram or family-tree analysis for malware's evolutionary development. However, our research finds that these techniques cannot support comprehensive malware evolution modelling, which provides a detailed explanation for why Android malware samples evolve in specific ways. This shortcoming is mainly caused by the coarse-grained clustering and analysis of malware samples. For example, because these works do not divide malware samples of a family into variant sets and explore the evolution principles among those sets, they usually fail to capture new variants that have been empowered by the feature ‘drifting’ in evolution. To address this problem, we propose a fine-grained and in-depth analysis of Android malware. Our experimental work systematically reveals the phylogenetic relationships among the variant sets for a deeper malware evolution analysis. We introduce five metrics: silhouette coefficient, creation date, variant labels, the presentativeness of the variant set formula, and the correctness of the linked edges to evaluate the correctness of our analysis. The results show that our variant clustering achieved a high silhouette value at a small sample distance (0.3), a small standard deviation (three months and 16 days) date based on when the malware samples are lastly modified, a high label consistency (91.4%), a high representativeness (93.1%) of the variant set formula. All the linked variant sets are connected based on our PhyloNet construction rules. We further analyse the coding details of Android malware for each variant set and summarise models of their evolutionary development. In this work, we successfully expose two major models of malware evolution:active evolutionandpassive evolution. We also disclose four technical explanations on the incentives of the two evolution models (two for each model respectively). These findings are valuable for proactive defence against newly emerged malware samples.

Behaviour analysis is essential for the security verification of suspicious Android applications, but analysts are usually faced with a huge obstacle when conducting the app behaviour analysis. They are expected to have comprehensive knowledge of different IT fields and a strong awareness of cyber threats. However, training a new security analyst typically requires a significant amount of time and can be extremely costly. Although there are tools available to assist analysts in studying Android behaviour and security, the completion of this task still heavily relies on the experience of the analysts. To address this problem, we recognise visualisation as a promising method and conduct a series of controlled experiments to demonstrate its effectiveness in the context of Android app behaviour and security analysis. We accordingly develop a visualisation tool based on apps’ call graphs (CG) (namedVisualDroid) and conduct an experiment and a follow-up interview. Compared to existing solutions, the results suggest that the CG-based visualisation solution (VisualDroid) can lower the barriers to Android behaviour and security analysis. The user study reveals that the platform includes CG-based visualisation components leads to a statistically significant improvement in Android behaviour analysis and security awareness. More specifically, it improvesAPK Analyzer,JD-GUI,JD-GUI+FlowDroidby 71.4%, 35.7%, and 39.2% in terms of the effectiveness of behaviour analysis. Participants who useVisualDroidalso show improvements in the aspect of security awareness with an increase of 155% againstAPK Analyzer, 96% againstJD-GUI, and 59.3%JD-GUI+FlowDroid.

Android users are increasingly concerned with the privacy of their data and security of their devices. To improve the security awareness of users, recent automatic techniques produce security-centric descriptions by performing program analysis. However, the generated text does not always address users’ concerns as they are generally too technical to be understood by ordinary users. Moreover, different users have varied linguistic preferences that do not match the text. Motivated by this challenge, we develop an innovative scheme to help users avoid malware and privacy-breaching apps by generating security descriptions that explain the privacy and security related aspects of an Android app in clear and understandable terms. We implement a prototype system, PERSCRIPTION, to generate personalised security-centric descriptions that automatically learn users’ security concerns and linguistic preferences to produce user-oriented descriptions. We evaluate our scheme through experiments and user studies. The results clearly demonstrate the improvement on readability and users’ security awareness of PERSCRIPTION’s descriptions compared to existing description generators.