Volatile Memory Analysis Research Articles

Volatile data acquisition and analysis by using Memory Forensics techniques

Memory forensics is a vital component of digital investigations, involving the analysis of volatile memory (RAM) in computer systems to gather evidence, identify malicious activities, and reconstruct cybercrime incidents. This paper provides an overview of memory forensics, highlighting its definition, importance, purpose, and scope. It explores the evolution and significance of memory forensics in response to increasingly complex cyber threats. The memory forensics process is discussed, covering memory acquisition and analysis. Legal and ethical considerations related to the admissibility of memory evidence and privacy protection are examined. The paper also discusses the types of memory, including physical and virtual memory, and their characteristics and significance in memory forensics. Furthermore, it explores the memory acquisition process, different methods, tools, and techniques used, as well as the importance of preserving evidence integrity. Finally, the paper introduces various tools for memory analysis, such as Volatility, Volatility Workbench, FTK Imager, Encase, Hibernation Recon, and Xplico, and highlights their role in extracting valuable evidence from memory dumps.

Volatile Data Acquisition and Analysis by Using Memory Forensics Techniques

Memory forensics is a vital component of digital investigations, involving the analysis of volatile memory (RAM) in computer systems to gather evidence, identify malicious activities, and reconstruct cybercrime incidents. This paper provides an overview of memory forensics, highlighting its defini-tion, importance, purpose, and scope. It explores the evolution and significance of memory forensics in response to increasingly complex cyber threats. The memory forensics process is discussed, cover-ing memory acquisition and analysis. Legal and ethical considerations related to the admissibility of memory evidence and privacy protection are examined. The paper also discusses the types of memory, including physical and virtual memory, and their characteristics and significance in memory forensics. Furthermore, it explores the memory acquisition process, different methods, tools, and techniques used, as well as the importance of preserving evidence integrity. Finally, the paper introduces various tools for memory analysis, such as Volatility, Volatility Workbench, FTK Imager, Encase, Hibernation Recon, and Xplico, and highlights their role in extracting valuable evidence from memory dumps.

The Evolution of Volatile Memory Forensics

The collection and analysis of volatile memory is a vibrant area of research in the cybersecurity community. The ever-evolving and growing threat landscape is trending towards fileless malware, which avoids traditional detection but can be found by examining a system’s random access memory (RAM). Additionally, volatile memory analysis offers great insight into other malicious vectors. It contains fragments of encrypted files’ contents, as well as lists of running processes, imported modules, and network connections, all of which are difficult or impossible to extract from the file system. For these compelling reasons, recent research efforts have focused on the collection of memory snapshots and methods to analyze them for the presence of malware. However, to the best of our knowledge, no current reviews or surveys exist that systematize the research on both memory acquisition and analysis. We fill that gap with this novel survey by exploring the state-of-the-art tools and techniques for volatile memory acquisition and analysis for malware identification. For memory acquisition methods, we explore the trade-offs many techniques make between snapshot quality, performance overhead, and security. For memory analysis, we examined the traditional forensic methods used, including signature-based methods, dynamic methods performed in a sandbox environment, as well as machine learning-based approaches. We summarize the currently available tools, and suggest areas for more research.

Browsers’ Private Mode: Is It What We Were Promised?

Web browsers are one of the most used applications on every computational device in our days. Hence, they play a pivotal role in any forensic investigation and help determine if nefarious or suspicious activity has occurred on that device. Our study investigates the usage of private mode and browsing artefacts within four prevalent web browsers and is focused on analyzing both hard disk and random access memory. Forensic analysis on the target device showed that using private mode matched each of the web browser vendors’ claims, such as that browsing activity, search history, cookies and temporary files that are not saved in the device’s hard disks. However, in volatile memory analysis, a majority of artefacts within the test cases were retrieved. Hence, a malicious actor performing a similar approach could potentially retrieve sensitive information left behind on the device without the user’s consent.

Malware Analysis Using Volatility

Volatile Data of a computer is a temporary and they are created when a computer system is running aka in operational condition. They are removed immediately when the system powered off. It is stored on the Random Access Memory (RAM) and other temporary storage units such as Registars of the Computer and not in the main storage partitions of Hard Drives. It could be emails related information, chats or browser history, running processes related information, unsaved data, clipboard contents etc. The analysis of volatile memory for extracting forensic artifacts is called Memory Forensic. Volatile Memory contains the most valuable information about running programs and instructions including running system processes, kernel drivers, loaded modules, executed commands, executable paths, active Network Connections, etc.

Fine-grained analysis method for Android volatile memory

Android dominates the mobile operating system market. Volatile memory analysis of Android devices has been the focus of research on mobile forensics technology. However, due to the semantic gap between the kernel and the volatile memory allocator, existing Android volatile memory analysis methods are coarse-grained. With the volatile memory capacity of Android devices increasing, these methods cannot satisfy the need of Android volatile memory analysis accuracy. In this paper, we first discuss the address space layout of Android processes and the management mechanism of Jemalloc, the default Android volatile memory allocator. Then, we bridge the semantic gap by utilizing the boundary auto alignment feature of the data structure of Jemalloc. Finally, we propose a Fine-grained Analysis Method for Android volatile Memory, called FAMAM. Experimental results shows that FAMAM has an accurate data analysis capability as well as a good robustness. In addition, we successfully use FAMAM to discover new storage patterns for username and password of Wechat.

Volatile memory analysis using the MinHash method for efficient and secured detection of malware in private cloud

Today, most organizations employ cloud computing environments for both computational reasons and for storing their critical files and data. Virtual servers are an example of widely used virtual resources provided by cloud computing architecture. Therefore, virtual servers are considered an attractive target for cyber-attackers, who launch their attacks by malware such as the well-known remote access trojans (RATs) and more modern malware such as ransomware and cryptojacking. Existing security solutions implemented on virtual servers fail to detect these newly created malware (zero-day attacks). In fact, by the time the security solution is updated, the organization has likely already been attacked. In this study, we present a designated framework aimed at trusted and secured detection of newly created and unknown instances of malware on virtual machines in an organization's private cloud. We took volatile memory dumps from a virtual machine (VM) in a secured and trusted manner, and analyzed all of the data within the memory dumps using the MinHash method; MinHash is well suited for the accurate detection of malware in VMs based on efficient volatile memory dump comparisons. The proposed framework is evaluated in a comprehensive set of experiments of increasing difficulty in which we also measured the detection performance of different classifiers (both similarity and machine learning-based classifiers, using collections of real-world, professional, notorious malware and legitimate applications. The evaluation results show that our framework can detect the anomalous state of a virtual server, as well as known, new, and unknown malware, with very high TPRs (100% for ransomware and RATs) and very low FPRs (1.8% for ransomware and no FPR for RATs). We also show how the methodology's performance can be improved, in terms of required time and storage space, saving more than 86% of these resources. Finally, we demonstrate the generalization capabilities and practicality of our methodology by using transfer learning and learning from just one virtual server in order to detect unknown malware on a different virtual server.

Trusted system-calls analysis methodology aimed at detection of compromised virtual machines using sequential mining

Most organizations today employ cloud-computing environments and virtualization technology; Due to their prevalence and importance in providing services to the entire organization, virtual-servers are constantly targeted by cyber-attacks, and specifically by malware. Existing solutions, consisting of the widely-used antivirus (AV) software, fail to detect newly created and unknown-malware; moreover, by the time the AV is updated, the organization has already been attacked. In this paper, we present a during run-time analysis methodology for a trusted detection of unknown malware on virtual machines (VMs). We conducted trusted analysis of volatile memory dumps taken from a VM and focused on analyzing their system-calls using a sequential-mining-method. We leveraged the most informative system-calls by machine-learning algorithms for the efficient detection of malware in widely used VMs within organizations (i.e. IIS and Email server). We evaluated our methodology in a comprehensive set of experiments over a collections of real-world, advanced, and notorious malware (both ransomware and RAT), and legitimate programs. The results show that our suggested methodology is able to detect the presence of unknown malware, in an average of 97.9% TPR and 0% FPR. Such results and capabilities can form the ground for the development of practical detection-tools for both corporates and companies.

Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile memory

Cloud computing is one of today's most popular and important IT trends. Currently, most organizations use cloud computing services (public or private) as part of their computer infrastructure. Virtualization technology is at the core of cloud computing, and virtual resources, such as virtual servers, are commonly used to provide services to the entire organization. Due to their importance and prevalence, virtual servers in an organizational cloud are constantly targeted by cyber-attackers who try to inject malicious code or malware into the server (e.g., ransomware). Many times, server administrators are not aware that the server has been compromised, despite the presence of detection solutions on the server (e.g., antivirus engine). In other cases, the breach is detected after a long period of time when significant damage has already occurred. Thus, detecting that a virtual server has been compromised is extremely important for organizational security. Existing security solutions that are installed on the server (e.g., antivirus) are considered untrusted, since malware (particularly sophisticated ones) can evade them. Moreover, these tools are largely incapable of detecting new unknown malware. Machine learning (ML) methods have been shown to be effective at detecting malware in various domains. In this paper, we present a novel methodology for trusted detection of ransomware in virtual servers on an organization's private cloud. We conducted trusted analysis of volatile memory dumps taken from a virtual machine (memory forensics), using the Volatility framework, and created general descriptive meta-features. We leveraged these meta-features, using machine learning algorithms, for the detection of unknown ransomware in virtual servers. We evaluated our methodology extensively in five comprehensive experiments of increasing difficulty, on two different popular servers (IIS server and an email server). We used a collection of real-world, professional, and notorious ransomware and a collection of legitimate programs. The results show that our methodology is able to detect anomalous states of a virtual machine, as well as the presence of both known and unknown ransomware, obtaining the following results: TPR = 1, FPR = 0.052, F-measure = 0.976, and AUC = 0.966, using the Random Forest classifier. Finally, we showed that our proposed methodology is also capable of detecting an additional type of malware known as a remote access Trojan (RAT), which is used to attack organizational VMs.

Data Mining of Social Media Specific Strings for Rapid Forensic Investigation

Instant Messengers become an important means of communication. Millions of people. regardless of age, nationality, gender and computer skills, spend a lot of time using them every day. Thus, Social networks already occupied the place of traditional messaging systems of the past. More and more communications are migrating from public chat rooms and private messengers into online Social Networking Sites (SNSs). As cybercrimes mushroom in recent years, more and more digital crime investigations have strong relations to these SNSs. Communications extracted from SNSs can be extremely valuable and useful to all kinds of investigators including forensic investigators. We now apply the spotlight on distinct strings specific to each SNSs and volatile memory analysis and display of any case detail as a key to a successful digital investigation through rapid & improved retrieval performance.

Correlating messages from multiple IM networks to identify digital forensic artifacts

In recent years the usage of instant messaging (IM) has increased manifold. Recent reports show that law enforcement organizations are making requests for instant messaging information as a result of involvement in criminal activity. There can be multiple reasons for investigation of instant messenger histories. Among all issues, renown are involvement in fraudulent activities, social engineering, identity theft, spread of malicious software (worm) to circumvent innocent users or critical security devices, revealing IP address of correspondent for launching further attacks, IM spam and offensive material, in general for communicating with group members regarding corruption, target killing, gambling, kidnapping, theft, robbery, etc. In this paper, we focus on a unique case in which two group members of criminal network are communicating through IM aggregator (like Digsby) and using multiple IM protocols to complete a single conversation session instead of following a traditional single IM client such as Yahoo Messenger for whole conversation. We propose a method to identify that multiple IM protocols are used for single conversation session and describe how to establish a sequence of collected messages. An analysis of volatile memory is performed to collect the remnants of whole or partial conversation, as supportive or actual evidence.

An Intelligent Analysis Model for Multisource Volatile Memory

For the rapidly development of network and distributed computing environment, it make researchers harder to do analysis examines only from one or few pieces of data source in persistent data-oriented approaches, so as the volatile memory analysis either. Therefore, mass data automatically analysis and action modeling needs to be considered for reporting entire network attack process. To model multiple volatile data sources situation can help understand and describe both thinking process of investigator and possible action step for attacker. This paper presents a Game model for multisource volatile data and applies it to main memory images analysis with the definition of space-time feature for volatile element information. Abstract modeling allows the lessons gleaned in performing intelligent analysis, evidence filing and automating presentation. Finally, a test demo based on the model is also present to illustrate the whole procedure

Study on Live analysis of Windows Physical Memory

Memory forensics and data carving methods are usually used during volatile investigation and is nowadays a big area of interest. Volatile memory dump is used for offline analysis of live data. Live analysis of the running system gives the information of which events are going on. Volatile memory analysis can give the sensitive information such as User Ids, Passwords, Hidden Processes, Root kits, Sockets etc. which are not stored on the physical drive. This Paper represents various approaches and tools used to capture and analyse data from computer memory.

Acquisition and analysis of volatile memory from android devices

The Android operating system for mobile phones, which is still relatively new, is rapidly gaining market share, with dozens of smartphones and tablets either released or set to be released. In this paper, we present the first methodology and toolset for acquisition and deep analysis of volatile physical memory from Android devices. The paper discusses some of the challenges in performing Android memory acquisition, discusses our new kernel module for dumping memory, named dmd, and specifically addresses the difficulties in developing device-independent acquisition tools. Our acquisition tool supports dumping memory to either the SD on the phone or via the network. We also present analysis of kernel structures using newly developed Volatility functionality. The results of this work illustrate the potential that deep memory analysis offers to digital forensics investigators.