The Evolution of Volatile Memory Forensics

Nyholm, Hannah; Monteith, Kristine; Lyles, Seth; Gallegos, Micaela; DeSantis, Mark; Donaldson, John; Taylor, Claire

doi:10.3390/jcp2030028

The Evolution of Volatile Memory Forensics

Journal Article · Wed Jul 20 00:00:00 EDT 2022 · Journal of Cybersecurity and Privacy

DOI:https://doi.org/10.3390/jcp2030028· OSTI ID:1876935

Nyholm, Hannah; Monteith, Kristine; Lyles, Seth; Gallegos, Micaela; DeSantis, Mark; Donaldson, John; Taylor, Claire

The collection and analysis of volatile memory is a vibrant area of research in the cybersecurity community. The ever-evolving and growing threat landscape is trending towards fileless malware, which avoids traditional detection but can be found by examining a system’s random access memory (RAM). Additionally, volatile memory analysis offers great insight into other malicious vectors. It contains fragments of encrypted files’ contents, as well as lists of running processes, imported modules, and network connections, all of which are difficult or impossible to extract from the file system. For these compelling reasons, recent research efforts have focused on the collection of memory snapshots and methods to analyze them for the presence of malware. However, to the best of our knowledge, no current reviews or surveys exist that systematize the research on both memory acquisition and analysis. We fill that gap with this novel survey by exploring the state-of-the-art tools and techniques for volatile memory acquisition and analysis for malware identification. For memory acquisition methods, we explore the trade-offs many techniques make between snapshot quality, performance overhead, and security. For memory analysis, we examined the traditional forensic methods used, including signature-based methods, dynamic methods performed in a sandbox environment, as well as machine learning-based approaches. We summarize the currently available tools, and suggest areas for more research.

View Journal Article

Sponsoring Organization:: USDOE

Grant/Contract Number:: AC52-07NA27344

OSTI ID:: 1876935

Alternate ID(s):: OSTI ID: 1884642
OSTI ID: 1885656

Journal Information:: Journal of Cybersecurity and Privacy, Journal Name: Journal of Cybersecurity and Privacy Journal Issue: 3 Vol. 2; ISSN 2624-800X

Publisher:: MDPI AGCopyright Statement

Country of Publication:: Country unknown/Code not available

Language:: English

References (32)

Process based volatile memory forensics for ransomware detection Arfeen, Asad; Asim Khan, Muhammad; Zafar, Obad Concurrency and Computation: Practice and Experience, Vol. 34, Issue 4 https://doi.org/10.1002/cpe.6672	journal	October 2021
SandPrint: Fingerprinting Malware Sandboxes to Provide Intelligence for Sandbox Evasion Yokoyama, Akira; Ishii, Kou; Tanabe, Rui Research in Attacks, Intrusions, and Defenses https://doi.org/10.1007/978-3-319-45719-2_8	book	January 2016
MemScrimper: Time- and Space-Efficient Storage of Malware Sandbox Memory Dumps Brengel, Michael; Rossow, Christian Detection of Intrusions and Malware, and Vulnerability Assessment https://doi.org/10.1007/978-3-319-93411-2_2	book	January 2018
AMAL: High-fidelity, behavior-based automated malware analysis and classification Mohaisen, Aziz; Alrawi, Omar; Mohaisen, Manar Computers & Security, Vol. 52 https://doi.org/10.1016/j.cose.2015.04.001	journal	July 2015
Catch them alive: A malware detection approach through memory forensics, manifold learning and computer vision Bozkir, Ahmet Selman; Tahillioglu, Ersan; Aydos, Murat Computers & Security, Vol. 103 https://doi.org/10.1016/j.cose.2020.102166	journal	April 2021
A survey of main memory acquisition and analysis techniques for the windows operating system Vömel, Stefan; Freiling, Felix C. Digital Investigation, Vol. 8, Issue 1 https://doi.org/10.1016/j.diin.2011.06.002	journal	July 2011
Vis: Virtualization enhanced live forensics acquisition for native system Yu, Miao; Qi, Zhengwei; Lin, Qian Digital Investigation, Vol. 9, Issue 1 https://doi.org/10.1016/j.diin.2012.04.002	journal	June 2012
Correctness, atomicity, and integrity: Defining criteria for forensically-sound memory acquisition Vömel, Stefan; Freiling, Felix C. Digital Investigation, Vol. 9, Issue 2 https://doi.org/10.1016/j.diin.2012.04.005	journal	November 2012
Anti-forensic resilient memory acquisition Stüttgen, Johannes; Cohen, Michael Digital Investigation, Vol. 10 https://doi.org/10.1016/j.diin.2013.06.012	journal	August 2013
Memory forensics: The path forward Case, Andrew; Richard, Golden G. Digital Investigation, Vol. 20 https://doi.org/10.1016/j.diin.2016.12.004	journal	March 2017
Scanning memory with Yara Cohen, Michael Digital Investigation, Vol. 20 https://doi.org/10.1016/j.diin.2017.02.005	journal	March 2017
Gaslight: A comprehensive fuzzing architecture for memory forensics frameworks Case, Andrew; Das, Arghya Kusum; Park, Seung-Jong Digital Investigation, Vol. 22 https://doi.org/10.1016/j.diin.2017.06.011	journal	August 2017
A universal taxonomy and survey of forensic memory acquisition techniques Latzo, Tobias; Palutke, Ralph; Freiling, Felix Digital Investigation, Vol. 28 https://doi.org/10.1016/j.diin.2019.01.001	journal	March 2019
A lightweight live memory forensic approach based on hardware virtualization Cheng, Yingxin; Fu, Xiao; Du, Xiaojiang Information Sciences, Vol. 379 https://doi.org/10.1016/j.ins.2016.07.019	journal	February 2017
A survey on machine learning-based malware detection in executable files Singh, Jagsir; Singh, Jaswinder Journal of Systems Architecture, Vol. 112 https://doi.org/10.1016/j.sysarc.2020.101861	journal	January 2021
A Survey on Machine Learning Techniques for Cyber Security in the Last Decade Shaukat, Kamran; Luo, Suhuai; Varadharajan, Vijay IEEE Access, Vol. 8 https://doi.org/10.1109/ACCESS.2020.3041951	journal	January 2020
Automated RAM analysis mechanism for windows operating system for digital investigation Meyers, Charl; Ikuesan, Adeyemi R.; Venter, Hein S. 2017 IEEE Conference on Application, Information and Network Security (AINS) https://doi.org/10.1109/AINS.2017.8270430	conference	November 2017
An Approach to Detect Fileless Malware and Defend its Evasive mechanisms Sanjay, B. N.; Rakshith, D. C.; Akash, R. B. 2018 3rd International Conference on Computational Systems and Information Technology for Sustainable Solutions (CSITSS) https://doi.org/10.1109/CSITSS.2018.8768769	conference	December 2018
Memory forensics using virtual machine introspection for Malware analysis Tien, Chin-Wei; Liao, Jian-Wei; Chang, Shun-Chieh 2017 IEEE Conference on Dependable and Secure Computing https://doi.org/10.1109/DESEC.2017.8073871	conference	August 2017
An Automated Tool for Memory Forensics Murthaja, Mifraz; Sahayanathan, Benjamine; Munasinghe, A. N. T. S. 2019 International Conference on Advancements in Computing (ICAC) https://doi.org/10.1109/ICAC49085.2019.9103416	conference	December 2019
Forensic analysis of windows user space applications through heap allocations Cohen, Michael 2015 20th IEEE Symposium on Computers and Communication (ISCC), 2015 IEEE Symposium on Computers and Communication (ISCC) https://doi.org/10.1109/ISCC.2015.7405522	conference	July 2015
Comparative Analysis of Volatile Memory Forensics: Live Response vs. Memory Imaging Aljaedi, Amer; Lindskog, Dale; Zavarsky, Pavol 2011 IEEE Third Int'l Conference on Privacy, Security, Risk and Trust (PASSAT) / 2011 IEEE Third Int'l Conference on Social Computing (SocialCom), 2011 IEEE Third Int'l Conference on Privacy, Security, Risk and Trust and 2011 IEEE Third Int'l Conference on Social Computing https://doi.org/10.1109/PASSAT/SocialCom.2011.68	conference	October 2011
VolMemLyzer: Volatile Memory Analyzer for Malware Classification using Feature Engineering Lashkari, Arash Habibi; Li, Beiqi; Carrier, Tristan Lucas 2021 Reconciling Data Analytics, Automation, Privacy, and Security: A Big Data Challenge (RDAAPS) https://doi.org/10.1109/RDAAPS48126.2021.9452028	conference	May 2021
Secure, Consistent, and High-Performance Memory Snapshotting Cox, Guilherme; Yan, Zi; Bhattacharjee, Abhishek CODASPY '18: Eighth ACM Conference on Data and Application Security and Privacy, Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy https://doi.org/10.1145/3176258.3176325	conference	March 2018
Volatile Memory Forensics Acquisition Efficacy: A Comparative Study Towards Analysing Firmware-Based Rootkits Taylor, Jacob; Turnbull, Benjamin; Creech, Gideon ARES 2018: International Conference on Availability, Reliability and Security, Proceedings of the 13th International Conference on Availability, Reliability and Security https://doi.org/10.1145/3230833.3232810	conference	August 2018
Introducing the Temporal Dimension to Memory Forensics Pagani, Fabio; Fedorov, Oleksii; Balzarotti, Davide ACM Transactions on Privacy and Security, Vol. 22, Issue 2 https://doi.org/10.1145/3310355	journal	May 2019
Dynamic Malware Analysis in the Modern Era—A State of the Art Survey Or-Meir, Ori; Nissim, Nir; Elovici, Yuval ACM Computing Surveys, Vol. 52, Issue 5 https://doi.org/10.1145/3329786	journal	September 2020
Malware Dynamic Analysis Evasion Techniques: A Survey Afianian, Amir; Niksefat, Salman; Sadeghiyan, Babak ACM Computing Surveys, Vol. 52, Issue 6 https://doi.org/10.1145/3365001	journal	November 2020
A state-of-the-art survey of malware detection approaches using data mining techniques Souri, Alireza; Hosseini, Rahil Human-centric Computing and Information Sciences, Vol. 8, Issue 1 https://doi.org/10.1186/s13673-018-0125-x	journal	January 2018
A Survey of Malware Detection Techniques based on Machine Learning Merabet, Hoda El; Hajraoui, Abderrahmane International Journal of Advanced Computer Science and Applications, Vol. 10, Issue 1 https://doi.org/10.14569/IJACSA.2019.0100148	journal	January 2019
Compression of Virtual-Machine Memory in Dynamic Malware Analysis Fowler, James Journal of Digital Forensics, Security and Law https://doi.org/10.15394/jdfsl.2017.1437	journal	January 2017
Malware detection using machine learning based analysis of virtual memory access patterns Xu, Zhixing; Ray, Sayak; Subramanyan, Pramod 2017 Design, Automation & Test in Europe Conference & Exhibition (DATE), Design, Automation & Test in Europe Conference & Exhibition (DATE), 2017 https://doi.org/10.23919/DATE.2017.7926977	conference	March 2017

Similar Records

FORENSIC ANALYSIS OF WINDOW’S® VIRTUAL MEMORY INCORPORATING THE SYSTEM’S PAGEFILE COUNTERINTELLIGENCE THROUGH MALICIOUS CODE ANALYSIS

Other · Fri Jun 01 00:00:00 EDT 2007 · OSTI ID:989478

Tools, Techniques, and Methodologies: A Survey of Digital Forensics for SCADA Systems

Conference · Fri Nov 30 23:00:00 EST 2018 · OSTI ID:1493135

Volatile Memory Extraction- Based Approach for Level 0-1 CPS Forensics

Conference · Fri Nov 01 00:00:00 EDT 2019 · OSTI ID:1606814

The Evolution of Volatile Memory Forensics

Citation Formats

References (32)

Similar Records

Related Subjects