AUMFOR: Automated Memory Forensics for Malware Analysis

Memory forensics plays a pivotal role in digital investigations, providing crucial insights into the activities and artifacts of an operating system. This paper explores the application of deep learning techniques in the domain of memory forensics within the Linux environment. Linux-based systems are widely used in various contexts, including servers, embedded devices, and desktops, making memory analysis in this ecosystem of paramount importance. Traditional memory forensics techniques have relied on manual analysis, which is often time-consuming and error prone. Deep learning, a subfield of machine learning, has demonstrated remarkable capabilities in pattern recognition and feature extraction tasks. In response, this paper presents a novel framework that automates and improves memory analysis through deep learning. Key components of this framework include data collection, preprocessing, feature extraction, and model selection. We introduce a unique dataset specifically curated for Linux memory forensics, facilitating the development and evaluation of deep learning models. Our experimental results demonstrate the efficacy of using a ResNet-50 model for detecting and classifying malware from memory dumps, achieving a detection rate of 98.75% and an accuracy rate of 89% in classifying malware types. Additionally, we acknowledged the challenges and limitations of applying deep learning in memory forensics, such as model interpretability and data privacy concerns. Future research directions are discussed, including real-time memory analysis integration and techniques for handling encrypted and compressed memory data.

Identification of cybercriminals has been always a challenge for law enforcement agencies, they utilize different techniques and methods to tackle this issue. An effective predictor not only helps law enforcement agencies to chase the criminals but also is beneficial for cyber security experts to profile cyber attackers and their method of attacks and plan broad strategies for preventing future cyber threats. In this research we aim to investigate the effect of classification techniques on prediction of cyber attackers in past and possible future cyber-attacks. Our investigation is based on Open Source Intelligence and historical data about cyber-attacks. To train our proposed predictors, we use different classification algorithms and by comparing their accuracy in prediction of cyber attackers we will nominate the most accurate and reliable model. Finally to evaluate the predictor we apply a test set to discover to what extent a predictor can help law enforcement agencies in their investigations to chase cyber criminals.

Due to the Internet of Things and the digitalization revolution, there is nowadays an overwhelming amount of cybersecurity information in the tech world. Dealing efficiently with cyber deviations and attacks is an emerging challenge to any cyber security industry all over the world. Traditional security solutions can no longer address today's security threats because of the rapid proliferation of various cyber-attacks and threats. Artificial intelligence understanding, especially machine learning technology can make a security system up to date by analyzing its security data so that the safety mechanism can be upgraded continuously and so that it can remain programmatic and automated. This study provides a comprehensive overview of existing machine-learning techniques inspired by the notion of AI. We explore its capabilities of advanced information analytics and management by deriving meaningful conclusions out of cyber data in Cybersecurity. The performance of the proposed method will be compared against that of a standard machine learning technique, Support Vector Machine (SVM), using cross-validation. This scheme is known as a Secured Learning based Data Evaluation Scheme (SLDES). Based on its analysis of past incidents and knowledge summaries from experts, the proposed AI approach SLDES (Shift Left Diverse Experiments and Simulations) would change or reform newly appearing sections as it retrieves recent events. Last but not least we present our research about the future of artificial intelligence in information security etc. Machine learning and its related approaches are being investigated and used in cyber defense, and the focus of the described section is to evaluate the current and future uses of machine learning in cyber defense, for the scheme proposed the section presented the way to demonstrate how to effect the proposed scheme is and the result metrics are plotted in histogram form To derive such insights and information necessary for designing countermeasures for such attacks, even as stated in, a thorough data analysis is important. The main aim of this research is to establish that clients can develop a safe situation to protect their electronic data from intruders.

The widespread adoption of advanced computing technologies, software applications and smart devices by companies has brought efficiency in the overall performance and productivity. However, these technologies created new avenues for cyber attackers. Cyber criminals have traditionally exploited corporate computing infrastructures for different motives: i) fun and challenge; ii) money; iii) stealing intellectual property rights; iv) hacktivism; v) misuse a computer system; and vi) to cause disruption and chaos. Governmental agencies have published guidelines to help companies better protect themselves against various types of cyber-attacks initiated by different motives. The focus of the existing research work has been on good cyber hygiene for companies by focusing more on the cyber security policies, controls and practices of a company. In this paper, we present a different viewpoint of cyber security by describing the attractiveness of a company as a potential target for cyber-attacks. Our proposed framework includes both technical computing and non-technical social aspects of a company, which can give a quick assessment about a company's attractiveness as a potential target. Our framework can significantly support the existing Cyber Hygiene programs as a first level of assessment and can be better utilized by various stakeholders to initiate more focused approach to achieve higher Cyber Hygiene ratings.

Cyber Security assumes a critical job in the field of Information and Communication Technology [ICT]. Securing the information has become one of the greatest difficulties in the present day. When we consider cyber security, the main aspect that strikes in our mind is ‘cyber crimes’ which are expanding enormously day by day. Different Governments and organizations are taking numerous measures so as to keep these cyber crimes. Other than different measures cyber security is as yet a big concern to many. This paper for the most part centers around difficulties looked by cyber security on the most recent technologies. It also focuses around most recent about the cyber security methods, ethics and the trends changing the appearance of cyber security. Governments, military, associations, budgetary foundations, colleges and different organizations gather, process and store a great deal of private data on PCs and transmit that data over systems to various PCs. With the tenacious quick advancement of volume and enhancement of cyberattacks, incite attempts are required to anchor touchy business and individual data, and to anchor national security. The paper talk with respect to the idea of the internet and shows how the web is unbound to transmit the mystery and budgetary data. We demonstrate that hacking is as of now typical and dangerous for overall economy and security and exhibited the diverse techniques for Cyber attacks in India and around the globe.

FIMAR: Fast incremental memory acquisition and restoration system for temporal-dimension forensic analysis

Memory forensics plays an important role in security and forensic investigations. Hence, numerous studies have investigated Windows memory forensics, and considerable progress has been made. In contrast, research on Linux memory forensics is relatively sparse, and the current knowledge does not meet the requirements of forensic investigators. Existing solutions are not especially sophisticated, and their complicated operation and limited treatment range are unsatisfactory. This paper describes an adaptive approach for Linux memory analysis that can automatically identify the kernel version and recovery symbol information from an image. In particular, given a memory image or a memory snapshot without any additional information, the proposed technique can automatically reconstruct the kernel code, identify the kernel version, recover symbol table files, and extract live system information. Experimental results indicate that our method runs satisfactorily across a wide range of operating system versions.

Forensics from volatile memory plays an important role in the investigation of cyber crime. The acquisition of RAM Memory or other terms of RAM dump can assist forensic investigators in retrieving much of the information related to crime. There are various tools available for RAM analysis including Volatility, which currently dominates open source forensic RAM tools. It has happened that many forensic investigators are thinking that they probably have malware in the RAM dump. And, if they do exist, they're still not very capable Malware Analysts, so it's hard for them to analyze the possibilities of malware in a RAM dump. The availability of tools such as Volatility allows forensic investigators to identify and link the various components to conclude whether the crime was committed using malware or not. However, the use of volatility requires knowledge of basic commands as well as static malware analysis. This work is done to assist forensic investigators in detecting and analyzing possible malware from dump RAM. This work is based on the volatility framework and the result is a Forensic tool for analyzing RAM dumps and detecting possible malware in it using machine learning algorithms in order to detect offline (not connected to the internet)

Cyber Security in the Gulf Cooperation Council

Today, webmail is being used in a number of organizations for all kinds of important communications as they move to cloud-based services. Several cyber threats involving phishing, malicious insider, unauthorized access to data and ransomware attacks are primarily carried out through webmail. This poses challenges and limitations for forensic investigators in the incident investigations involving emails, because actual email evidence is store at cloud service provider. The majority of work on email forensics and detection works on email information stored by email clients on desktop physical disk space. In order to gather artifacts from webmail used in browsers, volatile memory forensics is gaining popularity. However, few recent work utilizing memory forensics are focused on detecting email spoofing attempts from outside work by taking memory dumps of emails received by user from outside. This leaves the opportunity for malicious insiders to covertly send confidential data through webmail and remain undetected. In this work a novel framework is proposed, which models the malicious insider scenario and create the activity logs using volatile memory forensics. To implement and test the framework, a small tool was created using python. The framework is equally applicable for both public and private browsing. Our proposed method counters the limitation in previous schemes in terms of analyzing new email messages more efficiently using browser parent process ID. Our proposed method provides forensics investigators with a novel webmail tool that can be used to detect malicious email activity generated from with in the organisation.KeywordsEmail forensicsMalicious emailMemory forensicWebmail

The analysis of the volatile memory (RAM) of a computer system, known as memory forensics, is a critical component of modern digital forensics investigations. Since the evidence provided by memory forensics is vital, it is necessary for there to be automated solutions that implement the analysis. Volatility is the most widely used memory forensics framework and also contains the most functionality of all tools publicly available. Volatility, as well as all other memory forensics frameworks, are extremely complex software systems as they must parse a substantial number of in-memory data structures and their associated values. Given the reliance on memory forensics during digital investigations, robust automation of artifact extraction and presentation is required. In this study, novel methods for scalable fuzz testing were developed and the implementations of these methods were thoroughly evaluated against the Volatility framework. Fuzz testing is a technique in which a target program is intentionally fed faulty data in order to discover whether it enters an unexpected state during processing. The developed fuzzer generates thousands of mutations, each of which is specifically generated to stress test the algorithms of memory forensic frameworks. Since the developed library of mutation is so extensive, complete fuzz testing requires copious amounts of compute time and memory. To handle these requirements in a scalable and flexible manner, the developed system was designed to evenly distribute all resources, even when scaled to hundreds of compute cores. Distributed fuzzing of Volatility using the developed fuzz framework led to the discovery of many issues in Volatility's analysis engine, including it being vulnerable to resource exhaustion attacks, silent crashes, and unhandled exceptions.

Today, cloud computing has developed a transformative model for the organization, business, governments that brings huge potentials and turn into popular for pay as you go, on-demand service, scalability and efficient services. However, cloud computing has made the concern for forensic data because of the architecture of cloud system is not measured appropriately. Due to the distributed nature of the cloud system, many aspects relating to the forensic investigation such as data collection, data storage, crime target, data violation are difficult to achieve. Investigating the incidents in the cloud environment is a challenging task because the forensics investigator still needs to relay on the third party such as cloud service provider for performing their investigation tasks. It makes the overall forensic process difficult to complete with a duration and presented it to the court. Recently, there are some cloud forensics studies to address the challenges such as evidence collection, data acquisition, identifying the incidents and so on. However, still, there is a research gap in terms of consistency of analysing forensic evidence from distributed environment and methodology to analyse the forensic data in the cloud. This thesis contributes towards the direction of addressing the research gaps. In particular, this work proposes a forensic investigation framework CeFF: A framework for forensics enabled cloud investigation to investigate evidence in the cloud computing environment. The framework includes a set of concepts from organisational, technical and legal perspectives, which gives a holistic view of analysing cybercrime from organisation context where the crime has occurred through technical context and legal impact. The CeFF also includes a systematic process that uses the concept for performing the investigation. The cloud-enabled forensics framework meets all the forensics related requirement such as data collection, examination, presents the report, and identifies the potential risks that can consider while investigating the evidence in the cloud-computing environment. Finally, the proposed CeFF is applied to a real-life example to validate its applicability. The result shows that CeFF supports analysing the forensic data for a crime occurred in cloud-based system in a systematic way.

In spring 2011, the United States Naval Academy decided that, beginning in fall 2011, all first-year students would be required to take an introductory core course in the technical foundations of cyber security. This decision triggered our attempt to set an academic world-record for the development and implementation of a unique core course in six months time for all 1,200 incoming Midshipmen. The concern was that many graduates lacked an understanding of the risks and threats pertaining to cyber security, as cyber attacks and cyber crime become greater threats to the health and preservation of the nation. Such instruction simply could not wait; it had to be done, and done immediately. Throughout this paper we present the lessons we learned to provide guidance to others faced with the similar challenge of implementing a university-wide course while under a tight deadline. The insights we gained will prove useful to those thinking of implementing a technical core course, particularly one in cyber security.

The increasing number of cyber attacks has become a global problem for companies, public institutions, even for governments and for each particular user. Cyber crime causes damage of about 750 billion EUR every year in Europe alone. Thus, ICT security is nowadays a major concern, increasing the demand for specialists in this domain. Currently, universities do not produce enough graduates with strong network security skills able to defend against complex cyber attacks. Recently new EU approved ERASMUS+ project (DECAMP) addresses innovatively this educational aspect. DECAMP brings together within a framework of an international partnership 6 EU universities and 3 associated partners. The project is set up to create 6 online courses with integrated heterogeneous virtual hands-on lab environments covering ICT Security issues of various application areas. Each partner creates a course corresponding to its expertise. These courses can be accessed by all the students, professors and researchers of the universities within the DECAMP consortium as well as from other EU universities. The core of the DECAMP project is an online distributed virtual campus. The paper describes the procedure developed for controlling a secure access of various type of users to the platform of eLearning course materials. The solution complies on one hand with all the differences of enrollment procedures installed at each particular EU university to verify the type of user (student, teacher, researcher, etc) requiring access to the institution's resources. On the other hand the developed mechanism allows the users to obtain a single sign on (SSO) account which support their accesses to all distributed modules of the platform, placed at the corresponding universities which create and maintain them. A prototype system that has been deployed for testing the proposed solutions is also presented.

A study on cyber crimes, cyber attacks and prevention methods