Using Machine Learning to Detect Vault (Anti-Forensic) Apps

Michael N. Johnstone (), Wencheng Yang and Mohiuddin Ahmed
Additional contact information
Michael N. Johnstone: School of Science, Edith Cowan University, Perth, WA 6027, Australia
Wencheng Yang: School of Mathematics, Physics and Computing, University of Southern Queensland, Toowoomba, QLD 4350, Australia
Mohiuddin Ahmed: School of Science, Edith Cowan University, Perth, WA 6027, Australia

Future Internet, 2025, vol. 17, issue 5, 1-15

Abstract: Content hiding, or vault applications (apps), are designed with a secondary, often concealed purpose, such as encrypting and storing files. While these apps may serve legitimate functions, they unequivocally present significant challenges for law enforcement. Conventional methods for tackling this issue, whether static or dynamic, prove inadequate when devices—typically smartphones—cannot be modified. Additionally, these methods frequently require prior knowledge of which apps are classified as vault apps. This research decisively demonstrates that a non-invasive method of app analysis, combined with machine learning, can effectively identify vault apps. Our findings reveal that it is entirely possible to detect an Android vault app with 98% accuracy using a random forest classifier. This clearly indicates that our approach can be instrumental for law enforcement in their efforts to address this critical issue.

Keywords: software development; vault apps; content hiding; malware detection; machine learning; Android (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/17/5/186/pdf (application/pdf)
https://www.mdpi.com/1999-5903/17/5/186/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:17:y:2025:i:5:p:186-:d:1639652

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().