The increased use of mobile phones in security related applications has increased the need to verify device integrity. Consumers use smartphones as a form of online identification. Mobile phones provide law enforcement a useful surface for criminal prosecution. Manufacturers constantly patch vulnerabilities to prevent data leaks. Finding exploitable vulnerabilities, however, is non-trivial due to device encryption. One vector of attack is compromising a device driver to access privileged kernel information.

Finding exploits is difficult, time-consuming, and frequently requires in-depth knowledge of the surface under attack. Furthermore, software developers and manufacturers are continuously patching vulnerabilities and upgrading the interface. This makes finding vulnerabilities prone to errors, even for experts.

This thesis focusses on automating the process of finding vulnerabilities in Android device drivers. Several tools exist that automate part of the process, such as Syzkaller and the Evasion kernel. However, each individual tool leaves gaps in their use that make them impractical for realistic situations. Syzkaller is able to fuzz the Linux kernel, but often lacks the necessary components for fuzzing device drivers. The Evasion framework can emulate Android device drivers, but fuzzing these drivers requires in-depth knowledge of their internals.

Therefore, this thesis presents FELIX: a novel toolchain that is able to instrument and fuzz Android device drivers in an emulated environment. First, FELIX instruments the device driver and kernel in order to emulate the drivers without meeting the hardware requirements. Second, FELIX analyses the device driver to create the interface for a fuzzer. Lastly, FELIX uses Syzkaller to test the driver for vulnerabilities or exploits.

FELIX successfully fuzzed five different Android device drivers. In doing so, FELIX was able to reproduce known vulnerabilities, and managed to reach code that was previously uncovered. This demonstrates the ability of FELIX to discover new vulnerabilities in the future.

Clustering forms a major part of showing different relations between data points. Real-time clustering algorithms can visualise relationships between elements in a 3D environment, provide an analysis of data that is separate from the underlying structure and show how the data changes over time.
This paper analyses whether conventional clustering algorithms can be adapted to real-time dynamic data while remaining stable over time. By implementing an agglomerative hierarchical clustering algorithm combined with an exponential decay smoothing function, this paper tested several different distance functions and compared their resulting clusterings. It then derives a stable distance function for clustering sailboat competitors during a regatta and compared different smoothing values to see the impact on the final result.
The paper shows that an adaptively chosen smoothing value provides the best balance between cluster stability and an intuitive visualisation. This paper concludes this solution can be used and adapted to fit a multitude of applications by changing the distance function and the clustering depth.