This paper is published in Volume-4, Issue-4, 2018
Area
Digital Forensics
Author
Priya B Gadgil, Sangeeta Nagpure
Org/Univ
K. J. Somaiya College of Engineering, Mumbai, Maharashtra, India
Keywords
Memory forensics, Advanced volatile threat
Citations
IEEE
Priya B Gadgil, Sangeeta Nagpure. Hunting advanced volatile threats using memory forensics, International Journal of Advance Research, Ideas and Innovations in Technology, www.IJARIIT.com.
APA
Priya B Gadgil, Sangeeta Nagpure (2018). Hunting advanced volatile threats using memory forensics. International Journal of Advance Research, Ideas and Innovations in Technology, 4(4) www.IJARIIT.com.
MLA
Priya B Gadgil, Sangeeta Nagpure. "Hunting advanced volatile threats using memory forensics." International Journal of Advance Research, Ideas and Innovations in Technology 4.4 (2018). www.IJARIIT.com.
Priya B Gadgil, Sangeeta Nagpure. Hunting advanced volatile threats using memory forensics, International Journal of Advance Research, Ideas and Innovations in Technology, www.IJARIIT.com.
APA
Priya B Gadgil, Sangeeta Nagpure (2018). Hunting advanced volatile threats using memory forensics. International Journal of Advance Research, Ideas and Innovations in Technology, 4(4) www.IJARIIT.com.
MLA
Priya B Gadgil, Sangeeta Nagpure. "Hunting advanced volatile threats using memory forensics." International Journal of Advance Research, Ideas and Innovations in Technology 4.4 (2018). www.IJARIIT.com.
Abstract
Due to continuous growth in malware attacks, memory forensics has become very crucial as it contains many forensic artifacts that cyber forensic investigators cannot get through the traditional disk forensics. Forensic Analysis of a memory dump of victim's machine provides a detailed analysis of malware, checking traces of malware that have been created while running in the machine. Moreover, recent malware techniques also use stealthy methods to go undetected in typical disk forensics. Such techniques always execute exclusively from the memory or hide in the legitimate process to avoid the typical signature-based antivirus detection. Many of the recent studies also show that the percentage of such attacks have increased drastically. It is also estimated that the same trend will continue in the future and advanced threat like file less malware will become the major concern for the organizations as well as security researchers. This paper analyses memory forensics in the context of designing a forensic approach which will help to detect such advance malware threats. In this paper, we are analyzing a sample memory image infected by a malware. This paper proposes a generalized framework for doing step by step analysis of memory image for detecting fileless malware attacks.