Skip to main content
STRICT SociaLab

MalRec: A Blockchain-based Malware Recovery Framework for Internet of Things

STRICT SociaLab members Prof. Elena Ferrari, Prof. Barbara Carminati, Ahmed Lekssays, and Giorgia Sirigu have published their new paper entitled: “MalRec: A Blockchain-based Malware Recovery Framework for Internet of Things” in the Proceedings of the 17th International Conference on Availability, Reliability and Security (ARES 2022).

The following is the abstract of the new publication:

IoT devices have been considered an attractive target for malware (e.g., botnets) due to their low computational resources and lack of security measures. The literature focuses on detecting malware, but less attention is given to recovery solutions. In addition, with the development of data processing regulations in different countries, a need for transparent recovery systems that can help organizations present their due diligence arises. This work proposes a blockchain-based backup policy enforcement framework for IoT where an organization can formalize backup policies and enforce them. We have run our solution under extensive tests that show that it can be deployed in real-life IoT environments, despite the limited computational resources of IoT devices.

Research Papers, ,

A Risk Estimation Mechanism for Android Apps based on Hybrid Analysis

STRICT SociaLab members Prof. Elena Ferrari, Prof. Barbara Carminati, and Ha Xuan Son have published their new paper entitled: “A Risk Estimation Mechanism for Android Apps based on Hybrid Analysis” in the Data Science and Engineering journal.

The following is the abstract of the new publication:

Mobile apps represent essential tools in our daily routines, supporting us in almost every task. However, this assistance might imply a high cost in terms of privacy. Indeed, mobile apps gather a massive amount of data about individuals (e.g., users’ profiles and habits) and their devices (e.g., locations), where not all are strictly needed for app execution. According to privacy laws, apps’ providers must inform end-users on adopted data usage practices (e.g., which data are collected and for which purpose). Unfortunately, understanding these practices is a complex task for average end-users. The result is that they install apps without understanding their privacy implications. To support users in making more privacy-aware decisions on app usage, we propose a risk estimation approach based on an analysis of the app’s code. This analysis adopts a hybrid strategy, exploiting static and dynamic code analyses. Static analysis aims at discovering which personal data an app is collecting to determine whether the target app is asking more than required. This gives the first estimation of the app’s risk level. In addition, we also perform a dynamic analysis of the target app’s code. This further analysis helps determining whether the collected personal data is consumed locally on the mobile device or sent out to external services. If this happens, the risk level has to be increased, as personal data are more exposed. To prove the proposal’s effectiveness, we run several experiments involving different groups of participants. The obtained accuracy results are promising and outperform those obtained with static analysis only.

Research Papers, , ,