Papers for

mobile security analysts

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

Context-aware evidence extraction improves mobile sqlite forensics accuracy

A Symbolic-Neural Framework for Context-Aware Evidence Extraction from Mobile SQLite Databases

Abstract: Reliable forensic evidence extraction from mobile SQLite databases is challenging because application schemas are undocumented, evolve across releases, and differ across operating systems, making schema-specific methods brittle and difficult to maintain. We present SNEEF, a symbolic-neural framework for context-aware evidence extraction that encodes each SQLite row as context-value pairs with standardized provenance metadata and column labels, uses a language model to recognize nine forensic entity types, and binds each accepted entity to its source table and row through the PA-EEP provenance protocol. We evaluate SNEEF against examiner-verified ground truth from five corpora built from public Android and iOS device images, spanning multiple application versions. SNEEF achieves an F1 score of 0.967 for evidence entities extracted from SQLite row content, excluding application names, compared with 0.728 for a context-free configuration, with consistent gains across all corpora. We also introduce an Evidence Failure Mode taxonomy to characterize why extraction errors occur.

Mon 2 NovCryptography and Security
The gist
Extracting important evidence from mobile app databases is hard because the database layouts often change and are not well documented. The authors created a system called SNEEF that combines symbolic rules and neural language models to better understand and retrieve forensic data from these databases across different apps and devices. Their method links extracted information back to its original source for reliability. They tested it on real Android and iOS data and found it significantly improved accuracy over simpler approaches.
Open → 2611.03323v1

IOS location messages decode tool improves privacy analysis reliability

Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker

Abstract: Reverse engineering the data formats used by mobile software is skilled and slow, and using AI to assist with it is attractive. We evaluate this for the protobuf messages that an iPhone sends to Apple's location services. Working from Apple's binaries, we use two frontier models (Claude Opus 4.8, Codex GPT Sol 5.6) to reconstruct the schemas of protobufs observed in network traffic. The great majority of the schemas contain substantial errors, and these are hard to detect because the schemas are internally consistent. Direct AI use is therefore unsuitable for forensic and privacy analysis. AI can, however, write reliable analysis tools when their output can be validated. We use Claude to write a Python tool, Extractor, that reliably recovers protobuf schemas from Apple binaries. We validate it against binaries compiled from schemas with known answers, previously published schemas, and network measurements. We demonstrate the use of Extractor to decode and analyse the location services network traffic of a jailbroken iPhone 8 (iOS 16.7.11).

Thu 15 OctNetworking and Internet ArchitectureArtificial Intelligence
The gist
Figuring out the hidden details of location data sent by iPhones to Apple is usually a slow, tricky job that experts do. The authors tested if artificial intelligence can help with this task but found the AI often makes mistakes when trying to understand the data directly. However, AI can write tools to decode these messages correctly when the results can be double-checked. Using AI, they built a Python program that reliably extracts and reads these hidden data formats from iPhone software, helping to analyze iPhone location data more accurately.
Open → 2610.21597v1