Dump Files Research Articles

MDGraph: A novel malware detection method based on memory dump and graph neural network

Malware detection is of great importance to computer security. Although the malware detection approaches have made great progress in recent years, these methods are still limited in regard to identifying the advanced malware that conceals their malicious activities. To address this problem, we present a novel malware detection solution, MDGraph, which is based on the memory dump and graph neural network. MDGraph first dynamically grabs a memory dump file for a target process. Then, it applies the recursive disassembling technique to extract the program functions composed of assembly instruction sequences and the invocation relationship between functions from the memory dump. Next, the program functions are vectorized using the doc2vec model. Based on the vectorized functions and their connections, MDGraph leverages a graph neural network model for malware detection. The evaluation shows our method can identify unpacked and packed malware effectively, and it is superior to the recent malware detection methods based on the memory dump.

An Approach for Automatic Generating RESTFul API Code based on SQL DDL Code

RESTFul API is an emerging technology that is used for communication between various applications or systems. RESTFul API is commonly used in the development of systems and applications. Various application, such as mobile, web, or desktop, are use RESTFul API to handle and compute business processes. Currently, Development of the RESTFul API is easier with the code generator tools and some approaches that will generate RESTful API application automatically. With that tools, developers more easier dan efficient when developing their applications. In this research, we try to create a new approach to create a RESTFul API code generator. This approach is based on the SQL DDL code in the SQL dump file as input. We use this approach because, in the initial phase of building a system, developers must provide their database structure before building their applications. With proposed approach, RESTFul API code generator is more effective and suitable with the developer's workflow. Based on testing result, The proposed approach can perform well for automatic generating code for RESTful API based on SQL DDL given. And provide basic functionality in RESTFul API such as create, read, update, and delete data.

Statistical Prediction of [CII] Observations by Constructing Probability Density Functions Using SOFIA, Herschel, and Spitzer Observations

We present a statistical algorithm for predicting the [CII] emission from Herschel and Spitzer continuum images using probability density functions (PDFs) between the [CII] emission and continuum emission. The [CII] emission at 158[Formula: see text][Formula: see text]m is a critical tracer in studying the life cycle of interstellar medium and galaxy evolution. Unfortunately, its frequency is in the far-infrared (FIR), which is opaque through the troposphere and cannot be observed from the ground except for highly red-shifted sources ([Formula: see text]). Typically [CII] observations of closer regions have been carried out using suborbital or space observatories. Given the high cost of these facilities and limited time availability, it is important to have highly efficient observations/operations in terms of maximizing science returns. This requires accurate prediction of the strength of emission lines and, therefore, the time required for their observation. However, [CII] emission has been hard to predict due to a lack of strong correlations with other observables. Here we adopt a new approach to making accurate predictions of [CII] emission by relating this emission simultaneously to several tracers of dust emission in the same region. This is done using a statistical methodology utilizing PDFs among [CII] emission and Spitzer IRAC and Herschel PACS/SPIRE images. Our test result toward a star-forming region, RCW 120, demonstrates that our methodology delivers high-quality predictions with less than 30% uncertainties over 80% of the entire observation area, which is more than sufficient to test observation feasibility and maximize science return. The pickle dump files storing the PDFs and trained neural network module are accessible upon request and will support future FIR missions, for example, GUSTO and FIR Probe.

MRm-DLDet: a memory-resident malware detection framework based on memory forensics and deep neural network

Cyber attackers have constantly updated their attack techniques to evade antivirus software detection in recent years. One popular evasion method is to execute malicious code and perform malicious actions only in memory. Malicious programs that use this attack method are called memory-resident malware, with excellent evasion capability, and have posed huge threats to cyber security. Traditional static and dynamic methods are not effective in detecting memory-resident malware. In addition, existing memory forensics detection solutions perform unsatisfactorily in detection rate and depend on massive expert knowledge in memory analysis. This paper proposes MRm-DLDet, a state-of-the-art memory-resident malware detection framework, to overcome these drawbacks. MRm-DLDet first builds a virtual machine environment and captures memory dumps, then creatively processes the memory dumps into RGB images using a pre-processing technique that combines deduplication and ultra-high resolution image cropping, followed by our neural network MRmNet in MRm-DLDet to fully extract high-dimensional features from memory dump files and detect them. MRmNet receives the labeled sub-images of the cropped high-resolution RGB images as input of ResNet-18, which extracts the features of the sub-images. Then trains a network of gated recurrent units with an attention mechanism. Finally, it determines whether a program is memory-resident malware based on the detection results of each sub-image through a specially designed voting layer. We created a high-quality dataset consisting of 2,060 benign and memory-resident programs. In other words, the dataset contains 1,287,500 labeled sub-images cut from the MRm-DLDet transformed ultra-high resolution RGB images. We implement MRm-DLDet for Windows 10, and it performs better than the latest methods, with a detection accuracy of up to 98.34%. Moreover, we measured the effects of mimicry and adversarial attacks on MRm-DLDet, and the experimental results demonstrated the robustness of MRm-DLDet.

Effective One-Class Classifier Model for Memory Dump Malware Detection

Malware complexity is rapidly increasing, causing catastrophic impacts on computer systems. Memory dump malware is gaining increased attention due to its ability to expose plaintext passwords or key encryption files. This paper presents an enhanced classification model based on One class SVM (OCSVM) classifier that can identify any deviation from the normal memory dump file patterns and detect it as malware. The proposed model integrates OCSVM and Principal Component Analysis (PCA) for increased model sensitivity and efficiency. An up-to-date dataset known as “MALMEMANALYSIS-2022” was utilized during the evaluation phase of this study. The accuracy achieved by the traditional one-class classification (TOCC) model was 55%, compared to 99.4% in the one-class classification with the PCA (OCC-PCA) model. Such results have confirmed the improved performance achieved by the proposed model.

Memory Visualization-Based Malware Detection Technique.

Advanced Persistent Threat is an attack campaign in which an intruder or team of intruders establishes a long-term presence on a network to mine sensitive data, which becomes more dangerous when combined with polymorphic malware. This type of malware is not only undetectable, but it also generates multiple variants of the same type of malware in the network and remains in the system’s main memory to avoid detection. Few researchers employ a visualization approach based on a computer’s memory to detect and classify various classes of malware. However, a preprocessing step of denoising the malware images was not considered, which results in an overfitting problem and prevents us from perfectly generalizing a model. In this paper, we introduce a new data engineering approach comprising two main stages: Denoising and Re-Dimensioning. The first aims at reducing or ideally removing the noise in the malware’s memory-based dump files’ transformed images. The latter further processes the cleaned image by compressing them to reduce their dimensionality. This is to avoid the overfitting issue and lower the variance, computing cost, and memory utilization. We then built our machine learning model that implements the new data engineering approach and the result shows that the performance metrics of 97.82% for accuracy, 97.66% for precision, 97.25% for recall, and 97.57% for f1-score are obtained. Our new data engineering approach and machine learning model outperform existing solutions by 0.83% accuracy, 0.30% precision, 1.67% recall, and 1.25% f1-score. In addition to that, the computational time and memory usage have also reduced significantly.

Memory Forensics-Based Malware Detection Using Computer Vision and Machine Learning

Malware has recently grown exponentially in recent years and poses a serious threat to individual users, corporations, banks, and government agencies. This can be seen from the growth of Advanced Persistent Threats (APTs) that make use of advance and sophisticated malware. With the wide availability of computer-automated tools such as constructors, email flooders, and spoofers. Thus, it is now easy for users who are not technically inclined to create variations in existing malware. Researchers have developed various defense techniques in response to these threats, such as static and dynamic malware analyses. These techniques are ineffective at detecting new malware in the main memory of the computer and otherwise require considerable effort and domain-specific expertise. Moreover, recent techniques of malware detection require a long time for training and occupy a large amount of memory due to their reliance on multiple factors. In this paper, we propose a computer vision-based technique for detecting malware that resides in the main computer memory in which our technique is faster or memory efficient. It works by taking portable executables in a virtual environment to extract memory dump files from the volatile memory and transform them into a particular image format. The computer vision-based contrast-limited adaptive histogram equalization and the wavelet transform are used to improve the contrast of neighboring pixel and to reduce the entropy. We then use the support vector machine, random forest, decision tree, and XGBOOST machine learning classifiers to train the model on the transformed images with dimensions of 112 × 112 and 56 × 56. The proposed technique was able to detect and classify malware with an accuracy rate of 97.01%. Its precision, recall, and F1-score were 97.36%, 95.65%, and 96.36%, respectively. Our finding shows that our technique in preparing dataset with more efficient features to be trained by the Machine Learning classifiers has resulted in significant performance in terms of accuracy, precision, recall, F1-score, speed and memory consumption. The performance has superseded most of the existing techniques in its unique approach.

POKR: Building a Computable Heterogeneous Knowledge Resource for Precision Oncology.

Precision oncology is expected to improve selection of targeted therapies, tailored to individual patients and ultimately improve cancer patients' outcomes. Several cancer genetics knowledge databases have been successfully developed for such purposes, including CIViC and OncoKB, with active community-based curations and scoring of genetic-treatment evidences. Although many studies were conducted based on each knowledge base respectively, the integrative analysis across both knowledge bases remains largely unexplored. Thus, there exists an urgent need for a heterogeneous precision oncology knowledge resource with computational power to support drug repurposing discovery in a timely manner, especially for life-threatening cancer. In this pilot study, we built a heterogeneous precision oncology knowledge resource (POKR) by integrating CIViC and OncoKB, in order to incorporate unique information contained in each knowledge base and make associations amongst biomedical entities (e.g., gene, drug, disease) computable and measurable via training POKR graph embeddings. All the relevant codes, database dump files, and pre-trained POKR embeddings can be accessed through the following URL: https://github.com/shenfc/POKR.

Source files of the Carbohydrate Structure Database: the way to sophisticated analysis of natural glycans

The Carbohydrate Structure Database (CSDB, http://csdb.glycoscience.ru/) is a free curated repository storing various data on glycans of bacterial, fungal and plant origins. Currently, it maintains a close-to-full coverage on bacterial and fungal carbohydrates up to the year 2020. The CSDB web-interface provides free access to the database content and dedicated tools. Still, the number of these tools and the types of the corresponding analyses is limited, whereas the database itself contains data that can be used in a broader scope of analytical studies. In this paper, we present CSDB source data files and a self-contained SQL dump, and exemplify their possible application in glycan-related studies. By using CSDB in an SQL format, the user can gain access to the chain length distribution or charge distribution (as an example) in a given set of glycans defined according to specific structural, taxonomic, or other parameters, whereas the source text dump files can be imported to any dedicated database with a specific internal architecture differing from that of CSDB.

CASR: Analysis of Core Dump Files in Linux and Error Reporting

CASR: Analysis of Core Dump Files in Linux and Error Reporting

The memory forensic research oriented to segment heap in Windows 10 system

The current forensic research on heaps mainly extracts information from the heap of Linux and the NT heap of Windows. However, the study of how to extract the information on the segment heap in the Windows 10 from dump files is not sufficient. To reproduce the internal information on the segment heap, this paper proposes a method for locating and extracting the internal information on the segment heap in the Windows 10 according to the field offset in the vtype description information of memory object. The method uses the pool scanning technology to locate the process object, obtains the starting position of the process heap and scans the process heap according to the structural information on the process object and the process environment block object. Then it locates the position of the segment heap with its feature values, thereby extracting its internal information. Based on the analysis results, five forensic plugins for extracting the information on the segment heap were developed on the Volatility framework. The experimental results show that this method can effectively extract the information on the address of each segment heap and its internal components in the memory and on the size of committed memory, etc. The information can help investigators to analyze the digital traces left in the memory by cyber criminals or cyber attackers.

АНАЛІЗ ОПЕРАТИВНОЇ ПАМ’ЯТІ ЯК ОДИН ІЗ МЕТОДІВ ПРОВЕДЕННЯ КОМП’ЮТЕРНО-ТЕХНІЧНИХ КРИМІНАЛІСТИЧНИХ ДОСЛІДЖЕНЬ

Підходи та методи сучасної комп’ютерної криміналістики зазвичай оминають такий напрям досліджень, як аналіз оперативної пам’яті. Варто зауважити, що інформаційний вміст оперативної пам’яті працюючої операційної системи є досить цікавим об’єктом дослідження, оскільки може містити не тільки інформацію про роботу системи чи окремих процесів, а й відомості про авторизаційні дані чи ключі шифрування інформації. Аналіз системної пам’яті як окремий метод криміналістики загалом вимагає вирішення деяких проміжних питань, зокрема вибору інструменту для отримання її вмісту та засобу для дослідження створеного знімка. Ця робота має на меті вирішення зазначених питань. Аби аргументовано здійснити вибір того чи іншого засобу, в роботі проведено деяку апробацію програмного забезпечення та аналіз отриманих результатів.

DrugCentral 2021 supports drug discovery and repositioning.

DrugCentral is a public resource (http://drugcentral.org) that serves the scientific community by providing up-to-date drug information, as described in previous papers. The current release includes 109 newly approved (October 2018 through March 2020) active pharmaceutical ingredients in the US, Europe, Japan and other countries; and two molecular entities (e.g. mefuparib) of interest for COVID19. New additions include a set of pharmacokinetic properties for ∼1000 drugs, and a sex-based separation of side effects, processed from FAERS (FDA Adverse Event Reporting System); as well as a drug repositioning prioritization scheme based on the market availability and intellectual property rights forFDA approved drugs. In the context of the COVID19 pandemic, we also incorporated REDIAL-2020, a machine learning platform that estimates anti-SARS-CoV-2 activities, as well as the ‘drugs in news’ feature offers a brief enumeration of the most interesting drugs at the present moment. The full database dump and data files are available for download from the DrugCentral web portal.

I2P Forensic Analysis

I2P is an anonymous P2P distributed communication layer used to send messages to each other anonymously and safely. It is built on top of the internet and can be considered as an internet within the internet. Even though I2P is developed with an intention to create censorship resistant environment for the free flow of information, it is misused for illegal activities now a days. The possible misuses are less known among law enforcement agencies and existing industry approved software programs have no detection functionality for I2P. Because of the increased use of I2P in criminal purposes, there is a need for methods and tools to acquire and analyze digital evidence related to I2P. We conducted a detailed live memory dump analysis in order to find out the I2P related artifacts from a host machine. Furthermore, we propose a tool that will analyze the memory dump and system local files to find out the I2P related artifacts and provide a detailed report to the investigator.

AADIS: An atomistic analyzer for dislocation character and distribution

In atomistic simulations of crystal plasticity, the characterization and representation of the dislocation core structure play a significant role for the understanding of mechanical behavior for crystalline materials. For this purpose, we present an accurate and convenient command-line tool: Atomistic Analyzer for DISlocations character and distribution (AADIS) for the post-analysis of the defective structures observed in various atomistic simulations. The program has implemented the displacement vector analysis (DVA), the atomic strain tensor analysis (STA), the differential displacement analysis (DDA), the slip vector analysis (SVA), the interplanar disregistry analysis (IDA) and the Nye tensor analysis (NTA). Among these functionalities, a specific implementation of the program includes the extension of the NTA method and the characterization of misfit dislocations at bicrystal interfaces by various methods. The automatic feature provides a high throughput solution to the specific atomistic analysis on a batch of atomic configurations. Furthermore, several critical remarks on the advantages and shortcomings of each analysis method are revealed and discussed comprehensively, which provides guidance for their applications in atomistic simulations. Program summaryProgram title: AADISProgram files doi:http://dx.doi.org/10.17632/hgc34yd3m3.1Licensing provisions: GNU General Public License version 3Programming language: C++Nature of problem: To characterize and visualize the core structure of dislocations in atomic configurations for molecular dynamics (MD) simulations, including several vector and tensor analysis such as the Nye tensor [1].Solution method: Read a simulation dump file into the memory and then get it analyzed. Afterwards, the generated property will be printed into a new output dump file, which can be visualized by various free or commercial visualization software.

Automated Nonintrusive Analysis of Electronic System Level Designs

Due to the ever increasing complexity of hardware systems, designers strive for higher levels of abstractions in the early stages of the design process. Modeling hardware at the electronic system level (ESL) is one way to address this demand, with the C++-based system modeling framework SystemC and its abstract communication library transaction level modeling (TLM) having become de-facto standards for ESL system design. While the C++ compiler is sufficient to compile and simulate a given ESL design, for tasks of design understanding, debugging, or validation (where access to the details of design’s structure and behavior is necessarily required), design needs to be processed by an appropriate tool. This problem is often solved by adding instrumentation code to either the design or the library, usually resulting in incomplete logs, work overhead and/or incompatibilities. This paper introduces an approach that automatically extracts information about both, structure and behavior of SystemC designs and TLM transactions, nonintrusively. The information is retrieved from a given design by running it in debug mode while being connected to a preprogrammed debugger, thus leaving the existing sources and workflows untouched while collecting a vast amount of data without user intervention. Illustrating use cases, value change dump files of the SystemC models’ behavior and unified modeling language activity diagrams of transaction protocols are created automatically from simulation runs.

DrugCentral 2018: an update.

DrugCentral is a drug information resource (http://drugcentral.org) open to the public since 2016 and previously described in the 2017 Nucleic Acids Research Database issue. Since the 2016 release, 103 new approved drugs were updated. The following new data sources have been included: Food and Drug Administration (FDA) Adverse Event Reporting System (FAERS), FDA Orange Book information, L1000 gene perturbation profile distance/similarity matrices and estimated protonation constants. New and existing entries have been updated with the latest information from scientific literature, drug labels and external databases. The web interface has been updated to display and query new data. The full database dump and data files are available for download from the DrugCentral website.

A malware classification method based on memory dump grayscale image

Effective analysis of malware is of great significance in guaranteeing the reliability of the system operation. Malware can easily escape from existing dynamic analysis methods. Aiming at the deficiencies of current methods for detecting malware dynamically, a method of using hardware features is proposed, namely, a memory dump file is extracted and converted into a grayscale image, the image is converted into a fixed size, and the image feature is extracted using histogram of gradient, and the currently popular classifier algorithm is used to classify malware. Experiments are conducted using actual malware samples and the effectiveness of using memory dump file image is verified. This method is superior to the recently proposed hardware performance counter detection method.

AACSD: An atomistic analyzer for crystal structure and defects

We have developed an efficient command-line program named AACSD (Atomistic Analyzer for Crystal Structure and Defects) for the post-analysis of atomic configurations generated by various atomistic simulation codes. The program has implemented not only the traditional filter methods like the excess potential energy (EPE), the centrosymmetry parameter (CSP), the common neighbor analysis (CNA), the common neighborhood parameter (CNP), the bond angle analysis (BAA), and the neighbor distance analysis (NDA), but also the newly developed ones including the modified centrosymmetry parameter (m-CSP), the orientation imaging map (OIM) and the local crystallographic orientation (LCO). The newly proposed OIM and LCO methods have been extended for all three crystal structures including face centered cubic, body centered cubic and hexagonal close packed. More specially, AACSD can be easily used for the atomistic analysis of metallic nanocomposite with each phase to be analyzed independently, which provides a unique pathway to capture their dynamic evolution of various defects on the fly. In this paper, we provide not only a throughout overview on various theoretical methods and their implementation into AACSD program, but some critical evaluations, specific testing and applications, demonstrating the capability of the program on each functionality. Program summaryProgram title: AACSDProgram Files doi:http://dx.doi.org/10.17632/3hrmbbgp6s.1Licensing provisions: GNU General Public License 3 (GPL)Programming language: C++Nature of problem: Post-analysis of atomic configurations for LAMMPS [1] dump files, including crystals structure, defect and grain’s orientation.Solution method: Reading a LAMMPS custom dump file or LAMMPS data file from hard disk, get them analyzed and dumped to a new LAMMPS custom dump file together with the generated results, which can be visualized by OVITO [2].

A Digital Forensic Framework for Cloud Based on VMI

Traditional digital forensic methods become exceedingly feeble in cloud due to the fact that the basic infrastructure turns to virtualized environment. Leveraging properties of virtualization, virtual machine introspection has showed potential for cloud forensic. In this paper, we propose a novel framework, which contains a trustworthy independent agency, to provide memory digital forensic analysis (DFA) for virtual machines (VMs) in cloud. With the assistance of cloud platform, memory dump files can be obtained and transferred to the agency for further DFA, where information of VMs can be extracted using the proper tools. We described the constructional design of the framework. Test results showed the versatility of DFA and ability of malware detection. The framework indicates DFA can be purchased as a service only when there is a need in order to reduce the expenditures on maintaining exclusive facility and furnish standard procedure to multiple cloud platforms.