Evasion-aware Detection Sandbox

Informacje na temat projektu

EVADES

Identyfikator umowy o grant: 101158350

DOI

10.3030/101158350

Projekt został zamknięty

Data podpisania przez KE 21 Lutego 2024

Data rozpoczęcia 1 Marca 2024

Data zakończenia 31 Sierpnia 2025

Finansowanie w ramach

• European Research Council (ERC)

Koszt całkowity

Brak danych

Wkład UE

€ 150 000,00

Koordynowany przez

EURECOM GIE
France

Periodic Reporting for period 1 - EVADES (Evasion-aware Detection Sandbox)

Okres sprawozdawczy: 2024-03-01 do 2025-08-31

Podsumowanie kontekstu i ogólnych celów projektu

Mobile malware is getting harder and harder to detect and malicious apps regularly appear on the official Play Store, despite the considerable effort Google and the security industry put into early detection and validation of each application.

To mitigate this problem, the goal of EVADES is to combine a number of novel techniques developed as part of the ERC BitCrumbs project into the first evasion-resilient, scalable, and maintainable sandbox to analyze Android applications.
Our current prototype outperforms all open-source and commercial competitors, showing a significant technological advantage over the current market.
We already performed preliminary experiments and the results we obtained are as worrisome for users as they are encouraging to justify a business idea.
In fact, 70% of the Android malware we tested with our technology implemented some form of evasion targeting existing malware analysis tools.
This shows that the data we are using today to decide whether applications are benign or malicious is completely unreliable.

The EVADES project will focus on transforming our prototype into production software, developing the missing components required to produce an MVP, and exploring different ways we could sell and monetize our technology.

Prace wykonane od początku projektu do końca okresu sprawozdawczego oraz najważniejsze dotychczasowe rezultaty

We developed the first MVP of the product, which included the following activities:
- We completed all server-side development
- We built the cloud deployment, database, APIs
- We developed the web interface for the product
- We developed an array of novel features, such as a unique cleartext PCAP export (containing deciphered SSL traffic) and a Yara module to write signatures based on our reports.
- We tested and integrated all components
- We developed a ML classifier to assign a malicious score

We conducted a marked analysis of competitors and of possible clients.

Innowacyjność oraz oczekiwany potencjalny wpływ (w tym dotychczasowe znaczenie społeczno-gospodarcze i szersze implikacje społeczne projektu)

We are now in the process of registering the company and discuss with the first clients.