Francesco Bergadano

Cybersecurity models include provisions for legitimate user and agent authentication, as well as algorithms for detecting external threats, such as intruders and malicious software

This paper presents an innovative framework for the analysis of Mobile Applications, with specific emphasis on partial automation. Our methodology is based on a combination of static and dynamic analysis, allowing for increased overall accuracy. We adopted the OWASP “Mobile top 10” document as a guideline and a source for vulnerability relevance and statistics. The work has led to the development of a modular Framework, where each module aims at analyzing a specific vulnerability. The framework is multi-platform and allows to perform analyses on both Android and iOS devices. It also offers a graphical interface where the results of the analysis are reported. The implemented modules have focused, for the time being, on the analysis of Android applications, on the areas related to Data Storage and Network Communication, and on the Android Manifest. With the help of this framework, we have analyzed about 105 apps collected from the Google Play Store, for a number of different domains. In particular, we considered the apps that could collect and manage sensitive data, such as payment and banking data. The experimental results show that the framework is effective and accurate, and the set of discovered vulnerabilities suggest that it is necessary to increase security awareness not only for developers but also for users.

A novel approach to defacement detection is proposed in this paper, addressing explicitly the possible presence of a passive adversary. Defacement detection is an important security measure for Web Sites and Applications, aimed at avoiding unwanted modifications that would result in significant reputational damage. As in many other anomaly detection contexts, the algorithm used to identify possible defacements is obtained via an Adversarial Machine Learning process. We consider an exploratory setting, where the adversary can observe the detector’s alarm-generating behaviour, with the purpose of devising and injecting defacements that will pass undetected. It is then necessary to make to learning process unpredictable, so that the adversary will be unable to replicate it and predict the classifier’s behaviour. We achieve this goal by introducing a secret key—a key that our adversary does not know. The key will influence the learning process in a number of different ways, that are precisely defined in this paper. This includes the subset of examples and features that are actually used, the time of learning and testing, as well as the learning algorithm’s hyper-parameters. This learning methodology is successfully applied in this context, by using the system with both real and artificially modified Web sites. A year-long experimentation is also described, referred to the monitoring of the new Web Site of a major manufacturing company.

This paper develops a generalized “keyed learning” methodology and applies it to the problem of defacement detection. An implemented system is presented with a real-world experimentation, in the context of defacement response.

Effective analysis of applications (shortly apps) is essential to understanding apps' behavior. Two analysis approaches, i.e., static and dynamic, are widely used; although, both have well known limitations. Static analysis suffers from obfuscation and dynamic code updates. Whereas, it is extremely hard for dynamic analysis to guarantee the execution of all the code paths in an app and thereby, suffers from the code coverage problem. However, from a security point of view, executing all paths in an app might be less interesting than executing certain potentially malicious paths in the app. In this work, we use a hybrid approach that combines static and dynamic analysis in an iterative manner to cover their shortcomings. We use targeted execution of interesting code paths to solve the issues of obfuscation and dynamic code updates. Our targeted execution leverages a slicing-based analysis for the generation of data-dependent slices for arbitrary methods of interest (MOI) and on execution of the extracted slices for capturing their dynamic behavior. Motivated by the fact that malicious apps use Inter Component Communications (ICC) to exchange data [19], our main contribution is the automatic targeted triggering of MOI that use ICC for passing data between components. We implement a proof of concept, TelCC, and report the results of our evaluation.

The traditional, in-house software development process is progressively losing its appeal in favor of distributed, multi-site development: this is mainly due to the well-known advantages of the latter, such as higher productivity and lower costs. However, this practice has also some documented disadvantages that are inherent to distance: geographical, temporal and socio-cultural distances between stakeholders can affect communication, coordination and control activities, thus making collaboration very difficult. This would not immediately look as the ideal scenario for applying Agile methodologies, which definitely rely on continuous collaboration between all stakeholders, including (with a very important role) the customers. This paper analyzes issues related to collaboration between customers and developers in a distributed, Agile setting and proposes a framework that defines practices and tools for handling project information and communication activities.