Banking Trojans APK Detection using Formal Methods

Kumar, Nitesh; Kumar, Vinay; Gaur, Manish

doi:10.1109/iscon47742.2019.9036319

Cited by 2 publications

(4 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another widespread security threat in banking is malware. In this area the authors of [155] analysed Android banking applications using Krakatau byte-code tool 6 to generate the Java byte-code of the application, further translating it to Calculus of Communicating Systems (CCS) [183]. The authors then dispatched the CCS model to the Concurrency Workbench of New Century (CWB-NC) model checker [72] searching for malware properties.…”

Section: Financialmentioning

confidence: 99%

“…Specification languages. AADL (Architecture Analysis & Design Language) [18,73], ASF (Anonymous Secure Framework) [156], ASLan++ (AVANTSSAR Specification Language) [21], BAN logic [54,232], Boogie [34], Boxed Ambients [138], CASM (ASM-based SL for compilers) [257], CCS (Calculus of Communicating Systems) [155], COVERT (compositional analysis of Android apps) [29], CSP (Communicating Sequential Systems) [123], CSP# (shared variables CSP) [241], CTL (Computation tree temporal logic) [233], Cloud Calculus [138], Cryptol [92], Dynamic State Machine [189], ERC20 token contracts [203], Event-B [85], HLPSL (High Level Protocol Specification Language) [46], Hoare logic [111], LS2 (Logic of Secure Systems) [30], LTL (linear-time temporal logic) [271], Markov Decision Process [184], Petri nets [15], π -calculus [43], PlusCal [9], Promela [175], RTL (real-time logic) [113], SPDL (Security Protocol Description Language) [171], SysML-Sec [18], TLA+ (Temporal Logic of Actions) [75], Trusted CSP# [30], überSpark [257], VDM [101], Verilog [167], VHDL [114], VML [230], vTRUST [120], XMHF (eXtensible and Modular Hypervisor Framework)…”

Section: Specification Languages and Associated Toolsmentioning

confidence: 99%

“…Model checkers. AVISPA (Automated Validation of Internet Security Protocols and Applications) [22], Alloy [85], CBMC (Bounded Model Checker for C and C++) [61], CWB-NC (Concurrency Workbench of New Century) [155], Cadence IFV (RTL block-level verifier) [114], FDR [106], GROOVE [105], jKind [102], NuSMV [68], OFMC (on-the-fly model checker) [37], PAT (Process Analysis Toolkit for CSP#) [241], PRISM (probabilistic model checker) [184], SATMC (SAT-based model checker for security protocols) [46], SPIN [252], TRUSTFOUND [30], UPPAAL [179], UVHM (formal analysis scheme for hypervisors) [256].…”

Section: Specification Languages and Associated Toolsmentioning

confidence: 99%

“…Verification tools and frameworks. AndroBugs (Framework For Android Vulnerability Scanning) [245], Cl-Atse (protocol analyser) [144], FUDGE (Fuzz driver generator) [26], Frama-C [257], Krakatau [155], Maude (rewrite engine) [195], MobSF (mobile security framework) [130], phpSAFE [197], ProVerif [43], Quark [137], SAW (Software Analysis Workbench) [75], SMACK [75], SecGuru [139], SecVeriLog [95], Sugar (SAT-based) [172], TTool (translator from SysML-Sec to π -calculus) [18], Z3 [24].…”

Section: Specification Languages and Associated Toolsmentioning

confidence: 99%

See 3 more Smart Citations

A Survey of Practical Formal Methods for Security

et al. 2022

View full text Add to dashboard Cite

In today’s world, critical infrastructure is often controlled by computing systems. This introduces new risks for cyber attacks, which can compromise the security and disrupt the functionality of these systems. It is therefore necessary to build such systems with strong guarantees of resiliency against cyber attacks. One way to achieve this level of assurance is using formal verification, which provides proofs of system compliance with desired cyber security properties. The use of Formal Methods (FM) in aspects of cyber security and safety-critical systems are reviewed in this article. We split FM into the three main classes: theorem proving, model checking and lightweight FM. To allow the different uses of FM to be compared, we define a common set of terms. We further develop categories based on the type of computing system FM are applied in. Solutions in each class and category are presented, discussed, compared and summarised. We describe historical highlights and developments and present a state-of-the-art review in the area of FM in cyber security. This review is presented from the point of view of FM practitioners and researchers, commenting on the trends in each of the classes and categories. This is achieved by considering all types of FM, several types of security and safety-critical systems and by structuring the taxonomy accordingly. The article hence provides a comprehensive overview of FM and techniques available to system designers of security-critical systems, simplifying the process of choosing the right tool for the task. The article concludes by summarising the discussion of the review, focusing on best practices, challenges, general future trends and directions of research within this field.

show abstract

Section: Financialmentioning

confidence: 99%