Gabriele Gambaro
Overcoming the Limitations of Automation in Spyware Detection: Proactive Methodologies for Host and Network Forensics.
Rel. Andrea Atzeni, Paolo Dal Checco. Politecnico di Torino, Corso di laurea magistrale in Cybersecurity, 2026
|
Preview |
PDF (Tesi_di_laurea)
- Tesi
Licenza: Creative Commons Attribution Non-commercial No Derivatives. Download (12MB) | Preview |
Abstract
The proliferation of mobile spyware, both mercenary and commercial, represents a growing threat to digital privacy and personal safety. The detection methods currently in use rely heavily on Indicators of Compromise (IOCs) and static signature-based matching. This thesis provides an in-depth overview of the contemporary spyware landscape and presents an empirical evaluation of open-source detection tools, specifically SpyGuard and Mobile Verification Toolkit (MVT), on both Android and iOS platforms. Building on these findings, the research proposes methodologies to overcome the identified detection limitations. Experimental results show the limitation of signature-based approaches. While highly effective against known threats, these tools fail to detect unknown or evasive spyware, as well as variants with dynamic infrastructure, due to the absence of matching indicators in IOCs lists.
Furthermore, network-based detection systems face significant challenges due to the TLS encryption, VPN tunnelling, and strategic "sleeping periods" employed by spyware agents to evade traffic analysis
Relatori
Anno Accademico
Tipo di pubblicazione
Numero di pagine
Corso di laurea
Classe di laurea
URI
![]() |
Modifica (riservato agli operatori) |
