An APT Trojan Detection Method Based on Memory Forensics Techniques

Abstract

Advanced Persistent Threat (APT) is currently reported to be one of the most serious threats. It is very important to detect the APT Trojan as early as possible. There are three types of approaches to conduct APT detection: network traffic analysis, change controlling and sandboxing. Unfortunately, all these approaches have limitations in detecting unknown APT Trojans. This paper proposes a novel APT Trojan detection method by utilizing memory forensics techniques. The proposed method first acquires the raw physical memory image from a target running system and then finds the APT’s traces in the memory image based on the ATP’s characteristics and memory forensics techniques. If enough traces are found, we can judge that there must be Trojans in the target system. Experimental results show that the proposed method can effectively detect new APT Trojans.