Large Scale Heap Dump Embedding for Machine Learning: Predicting OpenSSH Key Locations - Archive ouverte HAL
Pré-Publication, Document De Travail (Preprint/Prepublication) Année : 2024

Large Scale Heap Dump Embedding for Machine Learning: Predicting OpenSSH Key Locations

Résumé

With the evolving landscape of cybersecurity, forensic analysis has become increasingly pivotal, especially with the integration of machine learning (ML) techniques. However, the use of ML in cybersecurity, and especially in heap dump analysis is still in its infancy, both due to the lack of quality datasets and the difficulty of processing large-scale heap dumps collections. Another complex task lies in the transition from raw byte heap dump data into dense vector representations, or embeddings, that can be used with ML models. This paper addresses these challenges by introducing a novel methodology and the Mem2Graph tool for processing large-scale heap dumps collections. This method has been introduced while developing a novel approach to enhance the detection of session keys in OpenSSH heap dumps. Such a novel approach has significantly advanced the state of the art in predicting the location of keys in OpenSSH heap dumps. Importantly, it paves the way for automated ML applications that leverage the structure and embeddings from reconstructed memory graphs, opening new frontiers in both cybersecurity and data science. --- The current document is the preprint of a peer-reviewed and published paper under embargo period: "This preprint has not undergone peer review (when applicable) or any post-submission improvements or corrections. The Version of Record of this contribution is published in "ICT Systems Security and Privacy Protection: 39th IFIP International Conference, SEC 2024, Edinburgh, UK, June 12–14, 2024, Proceedings", and is available online at https://doi.org/10.1007/978-3-031-65175-5_28".
Fichier principal
Vignette du fichier
masterarbeit_paper_submission_v1.pdf (148.08 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-04669620 , version 1 (08-08-2024)

Licence

Identifiants

Citer

Florian Rascoussier, Lise Lahoche. Large Scale Heap Dump Embedding for Machine Learning: Predicting OpenSSH Key Locations. 2024. ⟨hal-04669620⟩
78 Consultations
34 Téléchargements

Altmetric

Partager

More