Traditional ransomware deployment often relies on massive encryption procedure, triggering immediate detection by modern defense systems. This work introduces a paradigm shift in cryptographic attacks by framing ransomware execution as a Search-Based Software Engineering (SBSE) optimization problem. This approach addresses the persistence gap observed in modern threats, where attacks aim to remain undercover for hours rather than minutes. Using a Genetic Algorithm (GA), we optimize data encryption under a hard constraint on the statistical deviation from baseline system activity. We demonstrate that our evolved attack patterns can evade behavioral monitors under fingerprinting techniques. Our results suggest that search-based methods provide a powerful framework for generating evasive malware, highlighting an emerging challenge for automated software defense.
While most work focuses on executable code, AndroidMani fest.xml, serves as the primary entry point for application metadata and permission logic. Yet, it is often overlooked, making it a high-trust, low-scrutiny attack surface. We present ApkFuzz, an AFL-based fuzzer with bit-level mutations targeting the encoded region of AndroidManifest.xml in the APK file. We have identified 9 issues that cause crashes and enable Denial-of-Service (DoS) attacks in core tools, including Google’s apksigner and the widely used research tool DroidBot.
Fuzz testing finds security issues and improves robustness, however it has only two implicit test oracles: timeout and crash. Information theory gives a third: entropy, which is generic, low cost and widely applicable. Fuzz3 is programming language agnostic, treating software as a black box, searching its input space based on entropy distributions. Applied to 6 open source software, it found 4 bugs, 2 of which has already been fixed since we reported it to the original developers.
Search-based techniques are widespread in traditional software testing, especially in the area of configurability where poor configuration choices can lead to failures or degraded system performance. Search techniques have also demonstrated potential in parts of the cyber-physical domain such as in UAVs, where misconfigurations (or poorly selected parameters) are a concern. Implementing search-based strategies for UAVs can be difficult and expensive due to the time required to run simulations and automate fitness calculations. In this work, we propose Pelican, a fully simulation-based genetic algorithm for searching for misconfigurations in UAVs. We parallelize the simulation to reduce the time cost and improve scalability. We implement a proof of concept of Pelican and test it to search for misconfigurations in flight control software. Finally, we evaluate Pelican’s effectiveness and efficiency. We find that Pelican outperforms random and grid search-based baselines in finding abnormal behavior and show that the parallelization of the simulation step saves over 70 h of execution time on average compared to running sequentially.
Modern software is built as small, cohesive, loosely coupled, and independently deployable units called microservices. The size and complexity of legacy systems make their decomposition into microservices a time-consuming and error-prone process. Several approaches have been proposed to address this problem, known as monolithic decomposition, often using static analysis techniques that provide insights, such as inter-class dependencies, to assign classes to microservices. This paper introduces a new method, MLStractor, that uses embedding vectors rather than static analysis to perform method-level decomposition. The approach frames the decomposition problem as a multi-objective optimization problem and uses IBEA to solve it. Consequently, MLStractor offers an alternative solution for monolithic decomposition, enabling a coarser-grained decomposition without relying on inter-class dependencies to reflect the cohesion and coupling of microservices. Preliminary results indicate that MLStractor effectively extracts semantically cohesive microservices with inter-service coupling comparable to that of existing methods.
