Study on Live analysis of Windows Physical Memory

The analysis of the volatile memory (RAM) of a computer system, known as memory forensics, is a critical component of modern digital forensics investigations. Since the evidence provided by memory forensics is vital, it is necessary for there to be automated solutions that implement the analysis. Volatility is the most widely used memory forensics framework and also contains the most functionality of all tools publicly available. Volatility, as well as all other memory forensics frameworks, are extremely complex software systems as they must parse a substantial number of in-memory data structures and their associated values. Given the reliance on memory forensics during digital investigations, robust automation of artifact extraction and presentation is required. In this study, novel methods for scalable fuzz testing were developed and the implementations of these methods were thoroughly evaluated against the Volatility framework. Fuzz testing is a technique in which a target program is intentionally fed faulty data in order to discover whether it enters an unexpected state during processing. The developed fuzzer generates thousands of mutations, each of which is specifically generated to stress test the algorithms of memory forensic frameworks. Since the developed library of mutation is so extensive, complete fuzz testing requires copious amounts of compute time and memory. To handle these requirements in a scalable and flexible manner, the developed system was designed to evenly distribute all resources, even when scaled to hundreds of compute cores. Distributed fuzzing of Volatility using the developed fuzz framework led to the discovery of many issues in Volatility's analysis engine, including it being vulnerable to resource exhaustion attacks, silent crashes, and unhandled exceptions.

Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile memory

Advancements in malware development, including the use of file-less and memory-only payloads, have led to a significant interest in the use of volatile memory analysis by digital forensics practitioners. Memory analysis can uncover a wealth of information not available via traditional analysis, such as the discovery of injected code, hooked APIs, and more. Unfortunately, the process of analyzing such malicious code is largely left to analysts who must manually reverse engineer the code to discover its intent. This task is not only slow and error-prone, but is also generally left only to senior-level analysts to perform, given that significant reverse engineering skills are required. This work focuses on the use of code emulation to automatically complete one of the most common tasks of malware analysis -discovering a malware sample’s network activity. Our tool automatically discovers the locations where malware uses networking APIs, emulates the network operations, and records the parameters passed to those functions. Through the monitoring of such parameters, this work enables the automatic discovery of the IP addresses, domain names, and network ports utilized by malware to connect to remote command-and-control (C2) servers as well as accept incoming connections. This novel use of emulation applied to in-memory code provides significant benefits compared to traditional whole-system emulation, which requires a full executable to run and does not match the environment that malware executed during a live incident. In contrast, our approach can emulate any code in memory, including inside of shellcode buffers and memory-only libraries. The novel network API monitoring capabilities developed for this research project were written as an extension to HookTracer, which is an plugin for the Volatility memory analysis framework. HookTracer provides emulation of API hooks in memory, but does not target any specific network activity. The contribution of this work is the incorporation of network API monitoring into HookTracer, development of a test suite that ensures the parameter monitoring is correct, and the evaluation of the techniques we have developed against real-world malware.

Instant Messengers become an important means of communication. Millions of people. regardless of age, nationality, gender and computer skills, spend a lot of time using them every day. Thus, Social networks already occupied the place of traditional messaging systems of the past. More and more communications are migrating from public chat rooms and private messengers into online Social Networking Sites (SNSs). As cybercrimes mushroom in recent years, more and more digital crime investigations have strong relations to these SNSs. Communications extracted from SNSs can be extremely valuable and useful to all kinds of investigators including forensic investigators. We now apply the spotlight on distinct strings specific to each SNSs and volatile memory analysis and display of any case detail as a key to a successful digital investigation through rapid & improved retrieval performance.

For the rapidly development of network and distributed computing environment, it make researchers harder to do analysis examines only from one or few pieces of data source in persistent data-oriented approaches, so as the volatile memory analysis either. Therefore, mass data automatically analysis and action modeling needs to be considered for reporting entire network attack process. To model multiple volatile data sources situation can help understand and describe both thinking process of investigator and possible action step for attacker. This paper presents a Game model for multisource volatile data and applies it to main memory images analysis with the definition of space-time feature for volatile element information. Abstract modeling allows the lessons gleaned in performing intelligent analysis, evidence filing and automating presentation. Finally, a test demo based on the model is also present to illustrate the whole procedure

Volatile memory contains an affluence of information regarding the current state of the running system. Memory forensics techniques inspect RAM to extract information such as credentials, encryption keys, network activity and logs, malware, MFT records and the set of processes, open file descriptors currently executed by the operating system, etc. To achieve retrievability of potential artefacts, a memory dump should be taken prior to shutting down the system. It is the most vital aspect for carving information residing into the volatile memory. Volatile memory dump is used for offline investigation of volatile data. The analysis provides information regarding the activities being performed over the running system. This research focuses on our developed framework called as VolNet through which investigator can extract and analyse the artefacts related to network communication, social chats, cloud-based artefacts, private browsing and anonymous surfing and other potential artefacts that can be obtained from RAM dumps of live systems.

Memory forensics plays a pivotal role in digital investigations, providing crucial insights into the activities and artifacts of an operating system. This paper explores the application of deep learning techniques in the domain of memory forensics within the Linux environment. Linux-based systems are widely used in various contexts, including servers, embedded devices, and desktops, making memory analysis in this ecosystem of paramount importance. Traditional memory forensics techniques have relied on manual analysis, which is often time-consuming and error prone. Deep learning, a subfield of machine learning, has demonstrated remarkable capabilities in pattern recognition and feature extraction tasks. In response, this paper presents a novel framework that automates and improves memory analysis through deep learning. Key components of this framework include data collection, preprocessing, feature extraction, and model selection. We introduce a unique dataset specifically curated for Linux memory forensics, facilitating the development and evaluation of deep learning models. Our experimental results demonstrate the efficacy of using a ResNet-50 model for detecting and classifying malware from memory dumps, achieving a detection rate of 98.75% and an accuracy rate of 89% in classifying malware types. Additionally, we acknowledged the challenges and limitations of applying deep learning in memory forensics, such as model interpretability and data privacy concerns. Future research directions are discussed, including real-time memory analysis integration and techniques for handling encrypted and compressed memory data.

Day by day cyber crimes and attacks are growing exponentially, every year companies in worldwide lose billions of dollars due to cyber attacks. It has became very essential to investigate and indentify root of cyber attack. One of the popular techniques of investigating is Memory Forensics, which refers to analysis of volatile data in computer’s memory dump. Investigators conduct necessary memory forensics to investigate and identify attacks or malicious behaviours that do not leave easily detectable tracks on hard drive data. There are varieties of tools available for RAM analysis including Volatility, which currently dominates open source RAM forensic tools. However, use of volatility requires knowledge of command line tool and dynamic as well as static malware analysis; it becomes very complex and tedious process. The work mentioned in document is aimed to help forensic investigators and researchers by providing GUI based Tool for Automated Memory Forensics (AUMFOR). AUMFOR do perform all complex and tedious work automatically, it also analyzes and gives final accurate reports about possibilities of use of malware in committing a crime.

Digital investigation is becoming an increasing concern. Many digital forensic tools are being developed to deal with the challenge of investigating digital crimes. Acquisition of volatile memory is one of the vital steps of digital forensics process. Passwords data, indications of digital forensics methods, memory malware may be contained in volatile data which may overlooked by the investigator. The Success of memory acquisition mainly depends on the effectiveness of the memory acquisition tool. This paper compares memory forensics tools based on processing time and left artifacts on volatile memory. Furthermore, we examined how the processing time of the tools varies in terms of different volatile memory size. In order to conduct this work, we use the following tools: FTK Imager, Pro Discover, Nigilant32, Helix3(dd), OSForensics and Belkasoft RAM Capturer. The results show that Belkasoft RAM Capturer has the least amount of left artifacts, and it has also the lowest processing time. Moreover, this work concludes that tested tools are significantly different based on left artifacts on the volatile memory with 95% confidence level. Also, statistically, increasing the memory size × times does not increase the processing time × times of the tools.

In this paper, we consider the verification of the hypothesis in the research of computer incidents study, based on the analysis of attributes and their values with post-incident computer equipment. The essence of the hypothesis constitutes the ability to study computer incidents in the types of computer memory; analyzing only the attributes and their values, without taking into account the contents of the data. The paper describes the process of forming the attributes and their values post-incident computer equipment and also, describing how to create a database of existing computer incidents. In performing these computational experiments, consists of assessing the possibilities of investigating computer incidents on the basis of the analysis of attributes and their values in the created database. Forming an opinion regarding the more informative details about the computer incidents by analysis of attributes and their values from the volatile memory, NVRAM (Non Volatile Random Access Memory), network traffic complex.

Volatile Data of a computer is a temporary and they are created when a computer system is running aka in operational condition. They are removed immediately when the system powered off. It is stored on the Random Access Memory (RAM) and other temporary storage units such as Registars of the Computer and not in the main storage partitions of Hard Drives. It could be emails related information, chats or browser history, running processes related information, unsaved data, clipboard contents etc. The analysis of volatile memory for extracting forensic artifacts is called Memory Forensic. Volatile Memory contains the most valuable information about running programs and instructions including running system processes, kernel drivers, loaded modules, executed commands, executable paths, active Network Connections, etc.

Memory Analysis of macOS Page Queues

Natural and manmade disasters have increased significantly over the past few decades. These include, among many others, the recent floods in Japan (June/July 2018) and Barcelona attack of August 2017. The Japan floods had left around 200 people dead, 70 were reported missing, and over eight million people were ordered to evacuate their homes, with 2bn USD the estimated cost of flood rebuilding. Disaster management plays a key role in reducing the human and economic losses. Our earlier work has focused on developing a disaster management system leveraging technologies including vehicular ad hoc networks (VANETs) and cloud computing to devise city evacuation strategies. The work was later extended to incorporate traffic management plans for smart cities using deep learning techniques. In-memory computations and graphics processing units (GPUs) were used to address intensive and timely computational demands of deep learning over big data in disaster situations. This paper extends our earlier work and provides extended analysis and results of the proposed system. A system architecture based on in-memory big data management and GPU-based deep learning computations is proposed. We have used road traffic data made publicly available by the UK Department for Transport. The results show the effectiveness of the deep learning approach in predicting traffic behavior in disaster and evacuation situations. This is the first system which brings together deep learning, in-memory data-driven computations, and GPU technologies for disaster management.

Designing computing-in-memory (CIM) chips with synaptic plasticity can potentially support energy-efficient on-chip learning in edge devices for rapid local task adaptation. Its silicon implementation is challenging as it requires hybridizing nonvolatile and volatile memory (VM) and customized computational operations. In this work, we propose a plastic CIM (P-CIM) macro featuring: 1) the logic-compatible flash (LF) cells in a standard 14-nm logic process that can be integrated with static random access memory (SRAM) cells in the same array; 2) the plastic cell array (PCA) that can perform matrix elementwise multiplication (MEM) followed by matrix-vector multiplication (MVM) in a single clock cycle; 3) the differential merged-into-array analog-to-digital converter (DMA-ADC) with capacitor reuse and a multielement sparsity-aware (MESA) scheme to reduce area and power consumption. A P-CIM macro integrating 32 k LF cells, 4 k SRAM cells, and 32 8-bit DMA-ADCs is fabricated in a 14-nm FinFET logic process. It achieves a peak energy efficiency (EF) of 22.64 TOPS/W for the MEM-MVM operations. It achieves computing accuracies of 78.04% on the Omniglot one-shot learning task and 89.65% on the CIFAR-10 pattern memorization task.

Today, webmail is being used in a number of organizations for all kinds of important communications as they move to cloud-based services. Several cyber threats involving phishing, malicious insider, unauthorized access to data and ransomware attacks are primarily carried out through webmail. This poses challenges and limitations for forensic investigators in the incident investigations involving emails, because actual email evidence is store at cloud service provider. The majority of work on email forensics and detection works on email information stored by email clients on desktop physical disk space. In order to gather artifacts from webmail used in browsers, volatile memory forensics is gaining popularity. However, few recent work utilizing memory forensics are focused on detecting email spoofing attempts from outside work by taking memory dumps of emails received by user from outside. This leaves the opportunity for malicious insiders to covertly send confidential data through webmail and remain undetected. In this work a novel framework is proposed, which models the malicious insider scenario and create the activity logs using volatile memory forensics. To implement and test the framework, a small tool was created using python. The framework is equally applicable for both public and private browsing. Our proposed method counters the limitation in previous schemes in terms of analyzing new email messages more efficiently using browser parent process ID. Our proposed method provides forensics investigators with a novel webmail tool that can be used to detect malicious email activity generated from with in the organisation.KeywordsEmail forensicsMalicious emailMemory forensicWebmail