Malware Analysis Using Volatility

Memories are made of this

Flexible multi‐colored electrochromic and volatile memory devices are fabricated from a solution‐processable electroactive aromatic polyimide with starburst triarylamine unit. The polyimide prepared by the chemical imidization was highly soluble in many organic solvents and showed useful levels of thermal stability associated with high glass‐transition temperatures. The polyimide with strong electron‐donating capability possesses static random access memory behavior and longer retention time than other 6FDA‐based polyimides. The differences of the highest‐occupied and lowest unoccupied molecular orbital levels among these polyimides with different electron‐donating moieties are investigated and the effect on the memory behavior is demonstrated. The polymer film shows reversible electrochemical oxidation and electrochromism with high contrast ratio both in the visible range and near‐infrared region, which also exhibits high coloration efficiency, low switching time, and the outstanding stability for long‐term electrochromic operation. The highly stable electrochromism and interesting volatile memory performance are promising properties for the practical flexible electronics applications in the future.

In this paper, we consider the verification of the hypothesis in the research of computer incidents study, based on the analysis of attributes and their values with post-incident computer equipment. The essence of the hypothesis constitutes the ability to study computer incidents in the types of computer memory; analyzing only the attributes and their values, without taking into account the contents of the data. The paper describes the process of forming the attributes and their values post-incident computer equipment and also, describing how to create a database of existing computer incidents. In performing these computational experiments, consists of assessing the possibilities of investigating computer incidents on the basis of the analysis of attributes and their values in the created database. Forming an opinion regarding the more informative details about the computer incidents by analysis of attributes and their values from the volatile memory, NVRAM (Non Volatile Random Access Memory), network traffic complex.

Memory forensics and data carving methods are usually used during volatile investigation and is nowadays a big area of interest. Volatile memory dump is used for offline analysis of live data. Live analysis of the running system gives the information of which events are going on. Volatile memory analysis can give the sensitive information such as User Ids, Passwords, Hidden Processes, Root kits, Sockets etc. which are not stored on the physical drive. This Paper represents various approaches and tools used to capture and analyse data from computer memory.

This book explores the implications of non-volatile memory (NVM) for database management systems (DBMSs). The advent of NVM will fundamentally change the dichotomy between volatile memory and durable storage in DBMSs. These new NVM devices are almost as fast as volatile memory, but all writes to them are persistent even after power loss. Existing DBMSs are unable to take full advantage of this technology because their internal architectures are predicated on the assumption that memory is volatile. With NVM, many of the components of legacy DBMSs are unnecessary and will degrade the performance of data-intensive applications. We present the design and implementation of DBMS architectures that are explicitly tailored for NVM. The book focuses on three aspects of a DBMS: (1) logging and recovery, (2) storage and buffer management, and (3) indexing. First, we present a logging and recovery protocol that enables the DBMS to support near-instantaneous recovery. Second, we propose a storage engine architecture and buffer management policy that leverages the durability and byte-addressability properties of NVM to reduce data duplication and data migration. Third, the book presents the design of a range index tailored for NVM that is latch-free yet simple to implement. All together, the work described in this book illustrates that rethinking the fundamental algorithms and data structures employed in a DBMS for NVM improves performance and availability, reduces operational cost, and simplifies software development.

We present design and experimental results of a rapid single-flux-quantum (RSFQ) bit-serial microprocessor with reduced-size embedded random access memories (RAMs) and with a minimal instruction set, called CORE e2h. The microprocessors called CORE e series have been developed for demonstrating small-scale program execution, such as loop calculation and sorting, in order to show the first prototype of a stored-program computer using the RSFQ technology. The CORE e2h is the most simplified variation of the CORE e series, which is equipped with only two registers, and can execute 13 instructions. The target clock frequency for bit-serial operation is 50 GHz, while the designed system clock cycle is 2 GHz. We carefully designed every component, implementing functionality using a small number of Josephson junctions with a small footprint. We fabricated several chips of the CORE e2h microprocessor integrated with two 128-bit shift-register-based RAMs on the same die. We experimentally obtained correct operations for all the instructions, and confirmed high-speed transfer between the instruction memory and controller unit and between the data memory and datapath at around 50 GHz.

Digital investigation is becoming an increasing concern. Many digital forensic tools are being developed to deal with the challenge of investigating digital crimes. Acquisition of volatile memory is one of the vital steps of digital forensics process. Passwords data, indications of digital forensics methods, memory malware may be contained in volatile data which may overlooked by the investigator. The Success of memory acquisition mainly depends on the effectiveness of the memory acquisition tool. This paper compares memory forensics tools based on processing time and left artifacts on volatile memory. Furthermore, we examined how the processing time of the tools varies in terms of different volatile memory size. In order to conduct this work, we use the following tools: FTK Imager, Pro Discover, Nigilant32, Helix3(dd), OSForensics and Belkasoft RAM Capturer. The results show that Belkasoft RAM Capturer has the least amount of left artifacts, and it has also the lowest processing time. Moreover, this work concludes that tested tools are significantly different based on left artifacts on the volatile memory with 95% confidence level. Also, statistically, increasing the memory size × times does not increase the processing time × times of the tools.

: The goal of this research was to develop an embedded magnetic memory technology to be integrated into Complementary Metal Oxide Semiconductor (CMOS) integrated circuit fabrication process to provide radiation-hard, logic elements and small random-access memories. The goal is not to provide large scale, bulk memory, but latches and flip flops that serve as state and data registers for sequential logic, and configuration registers for configurable logic. The benefits to spacecraft systems include the ability to power-down a subsystem while retaining system state, thus saving energy until the subsystem is required. The subsystem can then be powered-up and begin operating in milliseconds. The technology is based on a unique, PacMan-shaped magnetic tunneling junction (MTJ) cell developed at the University of Idaho. The focus of this research is to refine the PacMan cell to make it practical for integration into CMOS circuits, to develop CMOS circuits that employ the magnetic cells, and to integrate the cells onto a CMOS process. The process produced two circuit designs based on magnetic memory elements: a magnetic latch, and a magnetic shadow memory to serve as a backup to volatile electronic memory.

An all digital architecture was presented to realize the logarithm modeled automatic gain control(AGC) loop based on field programmable gates array(FPGA) platform.The architecture is mainly made up of four modules,including envelope detector,coordinator rotation digital computer(CORDIC) based iterative realization of effective hyperbolic function,infinite impulse response(IIR) based loop filter,and reconfigurable control logic generator.Envelope detector can meet the filter performance requirement only with finite impulse response(FIR) filter of low order.Symmetric coefficient based transposed architecture reduces the number of multipliers in filter to the half.By approximation to analog integrator and suitable process,IIR based filter can simplify the architecture of digital integrator.The logarithm convertor is easy to be realized by CORDIC based iterative hyperbolic function processor.The architecture can also output with random precision,and realize the compromise of circuit resources and speed,which overcomes the high demand for random access memory(RAM) in traditional algorithms.With fully parallel pipeline architecture,the maximum working clock can achieve 206 MHz.Finally,the realization results based on the FPGA processor and the hardware simulation were given.Experimental results were consistent well with the theoretical analysis.

In-memory computing is a promising solution to solve the memory bottleneck problem which becomes increasingly unfavorable in modern machine learning systems. In this paper, we introduce an architecture of random access memory (RAM) incorporating deep learning inference abilities. Due to the digital nature of this design, the architecture can be applied to a variety of commercially available volatile and non-volatile memory technologies. We also introduce a multi-chip architecture to accommodate for varying network sizes and to maximize parallel computing ability. Moreover, we discuss the opportunities and limitations of in-memory computing as future neural networks scale, in terms of power, latency and performance. To do so, we applied this architecture to various prevalent neural networks, e.g. Artificial Neural Network (ANN), Convolutional Neural Network (CNN) and Transformer Network and compared the results.

Simulations have shown multi-armed bandit (MAB) algorithms to be suitable for optimizing channel hopping in IEEE 802.15.4 networks. Thus far, however, there appears to be no practical implementation of this approach, presumably because typical IEEE 802.15.4 nodes lack both floating-point unit (FPUs) and big amounts of random-access memory (RAM). In this paper, we propose fixed-point arithmetic and implementation shortcuts to circumvent these constraints. We focus on two specific multi-armed bandit (MAB) algorithms, namely sliding-window upper confidence bound (SW-UCB) and its predecessor discounted UCB (D-UCB). SW-UCB is particularly promising since it requires only tractable fixed-point arithmetic, while yielding high packet delivery ratios (PDRs) according to prior work. D-UCB, on the other hand, additionally opens up an implementation shortcut that saves RAM. Our implementations of SW-UCB and D-UCB are integrated into Contiki-NG, yet can also be used out-of-tree in a simulation environment. We show our SW-UCB (resp. D-UCB) implementation to attain PDRs of 98.6% (resp. 99.2%) under appropriate parameter settings in the context of intra-body communication. Also, we demonstrate D-UCB to incur a moderate RAM, program memory, and processing overhead on CC2538 SoCs, whereas we find SW-UCB too RAM-consuming for these chips. Finally, using Monte Carlo simulations, we show our SW-UCB and D-UCB implementations to perform equally well as floating-point counterparts.

Volatile memory contains an affluence of information regarding the current state of the running system. Memory forensics techniques inspect RAM to extract information such as credentials, encryption keys, network activity and logs, malware, MFT records and the set of processes, open file descriptors currently executed by the operating system, etc. To achieve retrievability of potential artefacts, a memory dump should be taken prior to shutting down the system. It is the most vital aspect for carving information residing into the volatile memory. Volatile memory dump is used for offline investigation of volatile data. The analysis provides information regarding the activities being performed over the running system. This research focuses on our developed framework called as VolNet through which investigator can extract and analyse the artefacts related to network communication, social chats, cloud-based artefacts, private browsing and anonymous surfing and other potential artefacts that can be obtained from RAM dumps of live systems.

This research presents a novel single-architecture universal shift register/counter with an integrated memory unit. A full swing gate diffusion input (GDI) flip-flop is designed and implemented in both a synchronous counter and a universal shift register. SRAMs are mostly utilized as cache memory due to their ability to retain data when the power is ON. Hence, a 4 × 4 SRAM-based on full swing gate diffusion input flip-flop is developed to act as a memory for the proposed single-architecture universal shift register / Counter with the memory unit. To enhance performance, a 4 × 4 SRAM based on the proposed GDI flip-flop is incorporated as the memory unit. The design aims to improve key performance metrics, including clock-to-Q delay, power-delay product, area, and static power consumption. Simulation results demonstrate a 25% reduction in clock-to-Q delay, 30% reduction in D-to-Q delay, 20.2% reduction in power-delay product, 14.9% reduction in area, and 28.6% reduction in static power consumption compared to conventional D-flip-flop designs. The proposed architecture is validated through simulations using Tanner EDA at 1.2 V operating conditions, confirming its efficiency and potential applicability in high-performance sequential circuits.

Time analysis is a common approach for testing and detecting methods for the performance analysis of computer systems. In the article it is shown, that measuring and identifying performances based on a benchmark is not sucient for the proper analysis of the computer systems behavior. The response time of the process is often composed of the execution of many subprocesses or many paths of execution. Under this assumption, it is presented, that both convolution and deconvolution methods can be helpful in obtaining time distributions and modeling of complex processes. In such a modeling the analysis of measurement errors is very important and was taken into consideration. The example of using the methods in buering process is also discussed.

Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile memory