DECADE - Deep Learning Based Content-hiding Application Detection System for Android

With the increasing demand for digital privacy, content-hiding (or vault) apps are becoming popular among mobile phone users. Content-hiding apps affiliate to decoy apps. They are used for hiding photos, text, or videos and appear to have an interface very similar to commonly-used utility/productivity/gaming applications (for example, a calculator user interface). While these kinds of applications are convenient for people and let them hide private data, it raises concerns among app security researchers about their presence in legit and illicit app markets. It can also set a barrier for digital investigators, practitioners, victim service agencies, and the intelligence community since these apps are known to encrypt/delete data and make it unrecoverable. Such data could be anything ranging from contraband to classified data. Our research focuses on developing a fully automated Android Vault app Identification and Extraction system, primarily from the Google Play store. Through the feature extractions from description and images of applications followed by various machine learning and deep learning models, the system successfully identifies the content-hiding applications. The system can also automatically extract the user data from vault applications running on Android phones. To facilitate the advancement of research, we also keep an inventory of vault apps found in the Google Play store and offer to trace such apps even if they get removed from the Google Play store for security/other reasons. Our methodology and findings can be further extended to detect and classify content-hiding and anti-forensic apps in any Android app market and not limited to the Google Play store.