Recently there is an upsurge in Android malware that use obfuscation and repackaging techniques for evasion. Malware may also combine both these techniques to create stealthy adversarial mimicry samples to launch mimicry attacks. In mimicry attacks, the adversary makes sure that the static and dynamic features present in the crafted malware mimics the features present in the legitimate applications. In such cases, the existing detection mechanisms may become less effective. We found that the malicious nature of Android applications can be determined by identifying certain subgraphs that appear in their system call graphs. These subgraphs can be determined with the help of spectral clustering mechanism present in EigenGCN. With this, the system call graph G will be partitioned into two subgraphs G1 and G2, in which the malicious functionality if any will be present in the subgraph G1. The graph Fourier transform based pooling technique in EigenGCN then computes the features of the subgraphs in the form of graph signals. This graph signals serve as a robust signature to detect malware. The proposed mechanism gave an accuracy of 98.7% on common malware, 97.3% on obfuscated malware, 97.8% on repackaged malware, and 90% on adversarial mimicry malware datasets. As far as we know, this is the first work that proposes a malware detection mechanism, that can detect common as well as obfuscated, repackaged, and mimicry malware in Android.

Cancelable biometric schemes are designed to extract an identity-preserving, non-invertible as well as revocable pseudo-identifier from biometric data. Recognition systems need to store only this pseudo-identifier, to avoid tampering and/or stealing of original biometric data during the recognition process. State-of-the-art cancelable schemes generate pseudo-identifiers by transforming the original template using either user-specific salting or many-to-one transformations. In addition to the performance concerns, most of such schemes are modality-specific and prone to reconstruction attacks as there are chances for unauthorized access to security-critical transformation keys. A novel, modality-independent cancelable biometric scheme is proposed to overcome these limitations. In this scheme, a cancelable template (pseudo identifier) is generated as a distance vector between multiple random transformations of the biometric feature vector. These transformations were done by grouping feature vector components based on a set of user-specific random vectors. The proposed scheme nullifies the possibility of template reconstruction as the generated cancelable template contains only the distance values between the different random transformations of the feature vector and it does not store any details of the biometric template. The recognition performance of the proposed scheme is evaluated for face and fingerprint modalities. Equal Error Rate ( EER ) of 1.5 is obtained for face and 1.7 is obtained for the fingerprint in the worst case.

The Android operating system commands a dominant market share of over 70% in the smartphone industry. However, this widespread usage has resulted in a concerning increase in malware applications. While existing static malware detection mechanisms are vulnerable to code obfuscation attacks, manipulating the runtime system call (syscall) sequence remains a significant challenge for attackers. Consequently, syscall-based malware detection mechanisms are gaining prominence. Current syscall-based malware detection approaches rely on machine learning algorithms, utilizing numerical features such as syscall frequencies and transition probability matrices. However, the wide range of values in these features necessitates large datasets for effective classifier training, and susceptibility to noise and outliers persists. As a result, there is an urgent need for a binary representation of dynamic features to improve malware detection efficiency. To address this challenge, our paper proposes an innovative syscall subsequence-based binary feature representation method for machine learning-driven malware detection. By employing the information gain method, we identify informative syscall subsequences. The proposed mechanism achieves an impressive 99% accuracy in detecting malware applications using just 50% of the training data, across both the Drebin/AMD and CICMalDroid2020 datasets.

Metaverse has been gaining the attention of industry and academia equally in the recent past. With the immense capabilities backed by cutting-edge technologies, it has the potential to revolutionize every domain, especially healthcare. Metaverse can help to give customized treatment by a specialist to a patient anywhere in the world. However, akin to any new technology, the adoption of a metaverse in healthcare is susceptible to security issues and vulnerabilities. A proper study of the weakness and potential vulnerabilities is required before the active integration of metaverse into healthcare. Therefore, in this paper, we analyze the existing applications of the metaverse and its enabling technologies in the healthcare domain and investigate the security issues that exist or are likely to arise. Through the literature analysis, we identified three essential metaverse components for future healthcare systems, namely, Extended Reality (XR), Blockchain, and Avatar. These components and their combinations in varying degrees will give different dimensions to metaverse-based healthcare solutions. Further, we analyzed the risks associated with these components and their combinations. Here, the overall risk assessment was based on the existing literature and vulnerabilities, new cyber attacks, and the current trend of cyber attacks in the healthcare domain. The vulnerabilities collected from the Common Vulnerabilities and Exposures (CVE) site were used for studying the risks associated with metaverse, healthcare and their integration.

Finger vein recognition is a promising biometric authentication technique that depends on the unique features of vein patterns in the finger for recognition. The existing finger vein recognition methods are based on minutiae features or binary features such as LBP, LLBP, PBBM etc. or from the entire vein pattern. However, the minutiae-based features cannot accurately represent the structural or anatomical aspects of the vein pattern. These issues with the minutia feature led to increased false matches. Recognition based on binary features have limitations such as increased false matches, sensitivity to the translation and rotation, security and privacy issues etc. A feature representation based on the anatomy of vein patterns can be an alternative solution to improve the recognition performance. In the IJCB 2020 conference, we showed that every finger vein image contains one or more of a kind of 4 special vein patterns which we refereed as Fork, Eye, Bridge, and Arch (FEBA). In this paper, we further enlarge this set to 6 vein patterns (F2EB2A) by identifying two variations in the Fork and Bridge vein patterns. Based on 6 anatomical features of the possible 6 vein patterns in a vein image, we define a $6\times $ 6 feature matrix representation for finger vein images. Since this feature representation is based on the anatomical properties of the local vein patterns, it provides template security. Further we show that, the proposed feature representation is invariant to scaling, translation, and rotation changes. The experimental results using two open datasets and an in-house dataset show that the proposed method has a better recognition performance when compared to the existing approaches with an EER around 0.02% and an average recognition accuracy of 98%.

Palm vein biometrics is a potential authentication technique. In addition to the inherent liveness property, the palm vein pattern exhibits high authentication accuracy and anti-spoofing capability due to the dense vein pattern and broad coverage area. However, the large palm size increases the acquisition device's cost and size and significantly hinders device miniaturization, resulting in the limited applicability of palm vein biometrics. A solution to this problem is to restrict the area of the palm vein pattern required for authentication. Towards this, in this paper, we explore the potential of partial palm vein patterns for authentication. Through experimentation with varied-sized partial palm vein images, we show that (14)th of palm vein pattern is adequate for individual authentication. Based on this observation, we propose an authentication framework using partial palm vein patterns. The system takes (14)th palm vein pattern as input in both the enrollment and authentication phase, and partial to full image matching is performed. We propose a rule-based image acquisition and stitching method for accurately converting partial images into full images during enrollment. The proposed partial palm vein authentication framework using elastic matching achieved an Equal Error Rate (EER) of 0.0202%, 0.1919%, and 0.2282% on the CASIA, VERA, and PUT datasets, respectively. Experiments using deep feature matching also gave comparable results to elastic matching.

The growing prevalence of Android applications (apps) has sparked concerns over the security of users' personal information. Of particular concern is the potential leakage of sensitive data, such as GPS locations, user contacts, and IMEI codes, to unauthorized entities. Existing security mechanisms primarily focus on binary classification, distinguishing between malicious and benign files, but fail to address the risks associated with potentially harmful benign apps that unintentionally leak information to third-party users. To bridge this gap, we propose a novel framework that combines static taint analysis and machine learning techniques to classify and identify risks in Android apps. The machine learning model is trained on a dataset comprising data flow-based features from 16,000 malware and benign apps. We evaluate its capability to estimate risks associated with unknown apps using a separate test dataset containing 4,000 apps. The classification accuracy of our mechanism is 94% among them 87 % of malware apps are identified as high-risk and over 1% of the benign apps are also identified as high-risk in the tested dataset. This research represents a significant step forward in enhancing app security and data privacy, catering to the evolving landscape of mobile app threats and ensuring a safer experience for Android users.

The idea of cancelable biometrics was proposed to ensure the privacy and security of user's original biometric data, which is collected for recognition by storing only transformed template in the database after applying irreversible operations. State of the art cancelable schemes use either biometric salting or non-linear transformations for generating protected template. However, biometric salting techniques suffer from the threat of unauthorized access to user specific key; whereas non-linear transformation based schemes have the inherent issue of performance degradation due to information loss. In order to overcome these limitations of the existing techniques, this work proposes a patch level distortion based cancelable scheme which can be applied for multiple modalities. In the proposed method, biometric images are divided into Voronoi patches and log Gabor feature vector of each patch is distorted by combining it with a function of difference vectors of other patches. Proposed scheme is able to eliminate the need of security critical user specific key and many to one transformations. Irreversibility is assured as the function of difference vectors of patches used as noise in distortion process is random enough and unpredictable for an intruder. Cancelability and non-linkability can be ensured by changing the number and location of seed points. Superior performance compared to state of the art techniques is obtained in distorted domain when experiments were conducted on CASIA face database.

These days it is found that malware authors tend to create new variants of existing Android malware by using various kinds of obfuscation techniques. These kinds of obfuscated malware applications can bypass all the current antimalware products which rely on static analysis techniques to detect the malicious behavior. Hence, it is essential to develop innovative dynamic analysis mechanisms for Android malware detection. It is known that, the malicious behavior of statically obfuscated malware applications can get reflected in the system call (syscall) trace generated by them. Most of the existing syscall based mechanisms depend only on the features derived from the syscall counts for malware detection. These syscall count related features are inadequate to capture many other useful characteristics related to the syscalls in a sequence. In order to overcome this limitation, we modeled the syscall trace of an application as an ordered graph which enabled to infer various kinds of features in the form of centrality measures related to that syscall trace of the application. Then, these centrality measures are fed to an ML model to predict the malicious behavior. From the implementation results, we found that our mechanism can detect malware apps with an accuracy of 0.99.

The popularity of Android mobile phones has caused more cybercriminals to create malware applications that carry out various malicious activities. The attacks, which escalated after the COVID-19 pandemic, proved there is great importance in protecting Android mobile devices from malware attacks. Intelligent Mobile Malware Detection will teach users how to develop intelligent Android malware detection mechanisms by using various graph and stochastic models. The book begins with an introduction to the Android operating system accompanied by the limitations of the state-of-the-art static malware detection mechanisms as well as a detailed presentation of a hybrid malware detection mechanism. The text then presents four different system call-based dynamic Android malware detection mechanisms using graph centrality measures, graph signal processing and graph convolutional networks. Further, the text shows how most of the Android malware can be detected by checking the presence of a unique subsequence of system calls in its system call sequence. All the malware detection mechanisms presented in the book are based on the authors' recent research. The experiments are conducted with the latest Android malware samples, and the malware samples are collected from public repositories. The source codes are also provided for easy implementation of the mechanisms. This book will be highly useful to Android malware researchers, developers, students and cyber security professionals to explore and build defense mechanisms against the ever-evolving Android malware. © 2023 Tony Thomas, Roopak Surendran, Teenu S. John, and Mamoun Alazab. All rights reserved.

Finger vein has become an appealing biometric trait due to its intrinsic nature, contactless acquisition and anti-spoofing capability when compared to other dominant biometric traits. The state-of-the-art intrinsic recognition derives vein patterns based on either curvature values, line tracking or deep neural networks. However, these methods extract artifacts such as noise, breaks and texture along with veins due to the problems such as irregular shading, poor contrast and blurriness in NIR images which affect the recognition accuracy. To deal with these issues, we propose a novel acquisition mechanism for vein patterns based on the pulsation of the veins. We propose to capture the pulsations from vein videos to accurately isolate the vein patterns. Besides, the proposed framework has an inherent method of detecting liveness along with recognition of the finger vein. To the best of our knowledge, this is the first work that utilizes the finger vein pulsations for biometric recognition. We acquired a finger vein video dataset, from 320 subjects, to evaluate the proposed method. The experimental results indicate that the proposed approach has a better recognition performance compared to the existing image-based approaches with an EER (%) of 0.8 and a recognition accuracy of 96.35%.