DFRWS Online

DFRWS 2014 Forensics Challenge Results

Overview   |   Results

Results

All submissions to the DFRWS2014 Forensic challenge dealt solely with Android malware.

Submissions were assessed using the following criteria:

• Novelty
• Practicality
• Amount of extracted information
• Usefulness of extracted information
• Development effort (R&D category only)

Practitioner

The winning Practitioner entry was submitted by Darell Tan, Sufatrio, Tong-Wei Chua at the Agency for Science, Technology and Research, Institute for Infocomm Research, Singapore. (i2r.a-star.edu.sg). This effort demonstrates the use of freely available tools to extract and examine Android malware, including APKTool, Androguard, FlowDroid, SuSi, ApkAnalyzer, ApkInspector, Dex2jar, and Procyon.

Researcher & Developer

The winning Researcher & Developer entry was submitted by Dongwoo Kim and Wootak Jung at the Chungnam National University, Information Security Lab. By providing a method and associated code to extract malicious executable code from memory in an Android emulator, this approach addresses the problem that some Android malware is using "encryption, dynamic class loading, anti-tamper and anti-debugging, making it more difficult and time-consuming to reach the main executable code with existing tools and methods."

Other Submissions

Two other R&D entries were submitted and are provided below.

Zhaoheng Yang and Ibrahim Baggili from the University of New Haven, Cyber Forensics Research and Education Group developed a tool called Android Malware INvestigation Tool (MINT) that presents information extracted by APKTool in a GUI, and attempts to calculate associated danger scores.

Nikolay Akatyev and Hojun Son from South Korea developed an Eclipse Plug-in that is available here (https://github.com/SeoulTech/Manal/wiki/Getting-started).

Acknowledgements

Judges: Eoghan Casey, Justin Grover, Mark Guido, Jared Ondricek (MITRE)

Assistance: Morgan Marquis-Boire (Citizenlab) & Sebastian Porst (Google)