This paper is published in Volume-4, Issue-4, 2018
Area
Digital Forensics
Author
Priya B Gadgil, Sangeeta Nagpure
Org/Univ
K. J. Somaiya College of Engineering, Mumbai, Maharashtra, India
Pub. Date
21 August, 2018
Paper ID
V4I4-1497
Publisher
Keywords
Memory forensics, Advanced volatile threat

Citationsacebook

IEEE
Priya B Gadgil, Sangeeta Nagpure. Hunting advanced volatile threats using memory forensics, International Journal of Advance Research, Ideas and Innovations in Technology, www.IJARIIT.com.

APA
Priya B Gadgil, Sangeeta Nagpure (2018). Hunting advanced volatile threats using memory forensics. International Journal of Advance Research, Ideas and Innovations in Technology, 4(4) www.IJARIIT.com.

MLA
Priya B Gadgil, Sangeeta Nagpure. "Hunting advanced volatile threats using memory forensics." International Journal of Advance Research, Ideas and Innovations in Technology 4.4 (2018). www.IJARIIT.com.

Abstract

Due to continuous growth in malware attacks, memory forensics has become very crucial as it contains many forensic artifacts that cyber forensic investigators cannot get through the traditional disk forensics. Forensic Analysis of a memory dump of victim's machine provides a detailed analysis of malware, checking traces of malware that have been created while running in the machine. Moreover, recent malware techniques also use stealthy methods to go undetected in typical disk forensics. Such techniques always execute exclusively from the memory or hide in the legitimate process to avoid the typical signature-based antivirus detection. Many of the recent studies also show that the percentage of such attacks have increased drastically. It is also estimated that the same trend will continue in the future and advanced threat like file less malware will become the major concern for the organizations as well as security researchers. This paper analyses memory forensics in the context of designing a forensic approach which will help to detect such advance malware threats. In this paper, we are analyzing a sample memory image infected by a malware. This paper proposes a generalized framework for doing step by step analysis of memory image for detecting fileless malware attacks.