Alessio Merlo

Creating coherent and explainable situational awareness (SA) in multiple operational domains remains a persistent challenge for modern command-and-control (C2) systems. Heterogeneous data sources, inconsistent semantics, and fragmented reasoning mechanisms hinder timely and accountable decision-making in multi-domain operations (MDOs). This paper presents the design of a scalable, ontology-driven architecture that unifies data ingestion, semantic integration, and predictive reasoning within a modular framework for SA and decision support. The architecture employs an ontology-centric semantic core to ensure interoperability and traceability across domains while maintaining a clear separation between the data, reasoning, and analytics layers. Each component is motivated by operational and cognitive requirements, with an emphasis on scalability, explainability, and integration readiness. A conceptual integration and validation path is outlined to guide future evaluation within synthetic and simulation-based environments such as High Level Architecture (HLA) federations and C2 Systems—Simulation Systems Interoperation Standard (C2SIM) ecosystems. Rather than reporting empirical results or system-level performance metrics, the paper offers a theoretically grounded, design-oriented contribution, explicitly positioned as a methodological and architectural framework at an early stage of technological maturity.

Stegomalware represents a critical and distinctive threat in mobile cybersecurity, as it conceals malicious payloads within seemingly benign application components. Although transformations of carrier images-such as rescaling or reencoding-could, in principle, disrupt these covert channels, implementing a practical dearming strategy requires an adaptive, computationally efficient, and fully compliant solution that adheres to Android's APK structure and signature verification requirements. To address this challenge, we introduce StegoDefender, a novel modular framework for Android that integrates seamlessly into the application lifecycle to perform preinstallation dearming, optionally augmented by cloud-assisted processing, while strictly preserving Android's integrity constraints. A key differentiating feature of StegoDefender is a configurable prefiltering layer that enables developers to incorporate tailored heuristics to exclude benign applications, thereby substantially reducing processing overhead. In addition, StegoDefender applies a set of selective image transformations specifically designed to preserve application functionality. Empirical evaluation on a diverse corpus of Android applications, including real-world stegomalware samples, shows that StegoDefender effectively neutralizes stealthy threats while maintaining the integrity and usability of legitimate apps.

From a little research experiment to an essential component of military arsenals, malicious software has constantly been growing and evolving for more than three decades. On the other hand, from a negligible market share, the Android operating system is nowadays the most widely used mobile operating system, becoming a desirable target for large-scale malware distribution. While scientific literature has followed this trend, one aspect has been understudied: the role of native code in malicious Android apps. Android apps are written in high-level languages, but thanks to the Java Native Interface (JNI), Android also supports calling native (C/C++) library functions. While allowing native code in Android apps has a strong positive impact from a performance perspective, it dramatically complicates its analysis because bytecode and native code need different abstractions and analysis algorithms, and they thus pose different challenges and limitations. Consequently, these difficulties are often (ab)used to hide malicious payloads. In this work, we propose a novel methodology to reverse engineering Android apps focusing on suspicious patterns related to native components, i.e., surreptitious code that requires further inspection. We implemented a static analysis tool based on such methodology, which can bridge the “Java” and the native worlds and perform an in-depth analysis of tag code blocks responsible for suspicious behavior. These tags benefit the human facing the reverse engineering task: they clearly indicate which part of the code to focus on to find malicious code. Then, we performed a longitudinal analysis of Android malware over the past 10 years and compared the recent malicious samples with actual top apps on the Google Play Store. Our work depicts typical behaviors of modern malware, its evolution, and how it abuses the native layer to complicate the analysis, especially with dynamic code loading and novel anti-analysis techniques. Finally, we show a use case for our suspicious tags: we trained and tested a machine learning algorithm for a binary classification task. Even if suspicious does not imply malicious, our classifier obtained a remarkable F1-score of 0.97, showing that our methodology can be helpful to both humans and machines.

Since Android is the most widespread operating system, malware targeting it poses a severe threat to the security and privacy of millions of users and is increasing from year to year. The response from the community was swift, and many researchers have ventured to defend this system. In this cat-and-mouse game, attackers pay special attention to flying under the radar of analysis tools, and the techniques to understand whether their app is under analysis have become more and more sophisticated. Moreover, these evasive techniques are also adopted by benign apps to deter reverse engineering, making this phenomenon pervasive in the Android app ecosystem. While the scientific literature has proposed many evasive techniques and investigated their impact, one aspect still needs to be studied: how and to what extent Android apps, both malware and goodware, use such controls. This paper fills this gap by introducing a comprehensive taxonomy of evasive controls for the Android ecosystem and a proof-of-concept app that implements them all. We release the app as open source to help researchers and practitioners to assess whether their app analysis systems are sufficiently resilient to known evasion techniques. We also propose DroidDungeon, a novel probe-based sandbox, which circumvents evasive techniques thanks to a substantial engineering effort, making the apps under analysis believe they are running on an actual device. To the best of our knowledge, currently, DroidDungeon is the only solution providing anti-evasion capabilities, maintainability, and scalability at once. Using our sandbox, we studied evasive controls in both benign and malicious Android apps, revealing insights about their purpose, differences, and relationships between evasive controls and packers/protectors. Finally, we analyzed how the execution of an app differs depending on the presence or absence of evasive counter-measures. Our main finding is that 14% and 4% of malicious and benign samples refrain from running in an analysis environment that does not correctly mitigate evasive controls.