Memory forensic: Acquisition and analysis mechanism for operating systems

Shree, Raj; Shukla, Ashwani Kant; Pandey, Ravi P.; Shukla, Vivek; Bajpai, Diksha

doi:10.1016/j.matpr.2021.05.270

Cited by 10 publications

(4 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Moreover, the second comparison is with [24] , a fast and complex model with medium accuracy compared to the proposed model. Furthermore, the third work was authored by [14] in which the speed of the model was not mentioned, but what is noteworthy in this work is the very high accuracy that is comparable to the accuracy of the proposed work and a similar level to the proposed method in terms of complexity. Ultimately, the fourth and last comparison is with [28] , which is medium in both speed and complexity while characterized by relatively high accuracy but still less accurate than the proposed model.…”

Section: Comparing the Proposed Model With Relevant Studiesmentioning

confidence: 74%

See 1 more Smart Citation

Obfuscated Malware Memory Detection Employing Lazy Instance Based Learner Algorithm Based On Manhattan Distance Function

Sabah Talabani,

Abdulhadi,

Ali

2024

PJBAS

View full text Add to dashboard Cite

Malware is a severe threat to the network and host system security. It is frequently the primary cause of many events, such as Distributed Denial-of-Service attacks (DDoS), spam emails, etc. The detection and elimination of Malware are the subjects of intensive study. As a result, many antivirus programs have been created to help identify and remove Malware. The issue with this antivirus software is that it uses an obsolete method of detecting Malware, the signature-matching approach, which the primary forms of code obfuscation may deceive. Since then, this has resulted in the creation of a new generation of metamorphic and polymorphic Malware. In this paper, we investigated using the Instance-Based Learner (IBK) algorithm for detecting obfuscated Malware in a given dataset. Utilizing the Lazy IBK technique in malware detection is beneficial because the algorithm can accurately detect and classify the obfuscated Malware in the dataset using the Manhattan Distance function, one of the most well-known distance metric functions for measuring the distance between points. We analyzed an obfuscated malware dataset of 58,596 records selected from 3 malware categories. The algorithm was illustrated on the dataset utilizing 10-fold cross-validation. The results demonstrate that the proposed algorithm can quickly and accurately detect obfuscated Malware with an accuracy of 99.99%, a precision of 100%, and a recall of 100%, respectively.

show abstract

Section: Comparing the Proposed Model With Relevant Studiesmentioning

confidence: 74%

“…Memory analysis that isn't done in realtime necessitates snapshots, and taking these snapshots is critical to ensuring that memory files aren't harmed. The memory analysis process could be changed by affected memory files, eliminating the analysis's reliability [14] .…”

Section: Related Workmentioning

confidence: 99%

Obfuscated Malware Memory Detection Employing Lazy Instance Based Learner Algorithm Based On Manhattan Distance Function

Sabah Talabani,

Abdulhadi,

Ali

2024

PJBAS

View full text Add to dashboard Cite

show abstract

“…The executor was able to reach the target machine because of the file. The practice of examining the volatile memory (RAM) of a device to find digital evidence for the investigation of a cybercrime or security incident is known as memory forensic analysis [30]. The analysis must be performed while the device is still operational because volatile memory (RAM) is used to store data that is lost when it is turned off.…”

Section: Figure 10 Hard Drive Storage Investigation F) Memory Forensicmentioning

confidence: 99%

Enhancing Cybersecurity Through Live Forensic Investigation of Remote Access Trojan Attacks using FTK Imager Software

Ritzkal,

Hendrawan,

Kurniawan

et al. 2024

IJSSE

View full text Add to dashboard Cite

This study discusses using FTK Imager software for live forensic investigations in order to track and analyze Remote Access Trojan assaults. In addition to helping organizations safeguard their assets and data against harmful cyberattacks, our research aims to improve computer system security. The knowledge of the presence of the Remote Access Trojan virus, notwithstanding its removal, is the advantage of this research. Installation of Kali Linux, forensic analysis using FTK Imager, and the development and usage of viruses are all part of this study methodology. The process included installing Kali Linux as a platform for the creation and execution of viruses, identifying and analyzing the presence of viruses using FTK Imager, and identifying and analyzing Remote Access Trojan attacks using disk and memory forensic analysis techniques. The research findings indicate that as soon as the target opens the generated virus, the executor gains complete access to the target machine. This allows the executor to follow the target around and record everything it does. As a forensic investigation tool, FTK Imager must be installed on the target in order to detect the virus that the executor developed. The target will thus find it simpler to use memory forensics or disk forensics to look for files created by the executor. describes how to use FTK Imager software to observe and analyze Remote Access Trojan assaults for use in real-world forensic investigations.

show abstract

“…Cybercrime activities in mobile telephones have expanded exponentially as they are utilized in many daily tasks, such as personal and business data storage and transfer, and in Internet-based communications [1]- [3]. With an alarming 188% increase in Windows Phone vulnerabilities and a 262% increase in iOS vulnerabilities, mobile devices have become one of the most prevalent weaknesses, increasing more than three times faster than other threats [4], [5]. Forensic investigation of mobile devices is especially difficult owing to the considerable evidence and technological levels.…”

Section: Introductionmentioning

confidence: 99%

Navigating the cyber forensics landscape a review of recent innovations

Panigrahi,

Barpanda,

Sethy

2024

IJ-ICT

View full text Add to dashboard Cite

<p><span>The extensive relevance of digital forensics in today's data-driven environment has been emphasized in this article. The free software and the commercial software community are debatable, despite users and developers often differing views on important topics like software safety and usability. This article primarily uses pre-defined criteria and a platform-oriented approach to examine promising freeware (Magnet Forensics and Sleuth Kit) vs. profitable (ProDiscover and Oxygen Forensic Suite) mobile forensics tools. Under diverse settings, the tools' capacity to develop and analyze forensically sound digital forensic media sources is validated. After erasing data, each media type was tested again after formatting. The study concludes with a comparison matrix that may aid in determining the best-fit option for the investigation's requirements among the tools. The findings indicate the potential for freeware to supplant numerous proprietary applications, as users can opt for freeware instead of incurring costs associated with proprietary software. Furthermore, this perception can be put into practice.</span></p>

show abstract

Memory forensic: Acquisition and analysis mechanism for operating systems

Cited by 10 publications

References 10 publications

Obfuscated Malware Memory Detection Employing Lazy Instance Based Learner Algorithm Based On Manhattan Distance Function

Obfuscated Malware Memory Detection Employing Lazy Instance Based Learner Algorithm Based On Manhattan Distance Function

Enhancing Cybersecurity Through Live Forensic Investigation of Remote Access Trojan Attacks using FTK Imager Software

Navigating the cyber forensics landscape a review of recent innovations

Contact Info

Product

Resources

About