AutoProfile: Towards Automated Profile Generation for Memory Analysis - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue ACM Transactions on Privacy and Security Année : 2021

AutoProfile: Towards Automated Profile Generation for Memory Analysis

Résumé

Despite a considerable number of approaches that have been proposed to protect computer systems, cyber-criminal activities are on the rise and forensic analysis of compromised machines and seized devices is becoming essential in computer security. This article focuses on memory forensics, a branch of digital forensics that extract artifacts from the volatile memory. In particular, this article looks at a key ingredient required by memory forensics frameworks: a precise model of the OS kernel under analysis, also known as profile . By using the information stored in the profile, memory forensics tools are able to bridge the semantic gap and interpret raw bytes to extract evidences from a memory dump. A big problem with profile-based solutions is that custom profiles must be created for each and every system under analysis. This is especially problematic for Linux systems, because profiles are not generic : they are strictly tied to a specific kernel version and to the configuration used to build the kernel. Failing to create a valid profile means that an analyst cannot unleash the true power of memory forensics and is limited to primitive carving strategies. For this reason, in this article we present a novel approach that combines source code and binary analysis techniques to automatically generate a profile from a memory dump, without relying on any non-public information. Our experiments show that this is a viable solution and that profiles reconstructed by our framework can be used to run many plugins, which are essential for a successful forensics investigation.

Dates et versions

hal-04611506 , version 1 (13-06-2024)

Identifiants

Citer

Fabio Pagani, Davide Balzarotti. AutoProfile: Towards Automated Profile Generation for Memory Analysis. ACM Transactions on Privacy and Security, 2021, 25 (1), pp.1-26. ⟨10.1145/3485471⟩. ⟨hal-04611506⟩

Collections

EURECOM
0 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Mastodon Facebook X LinkedIn More