Please use this identifier to cite or link to this item: https://rda.sliit.lk/handle/123456789/1607
Full metadata record
DC FieldValueLanguage
dc.contributor.authorMurthaja, M.-
dc.contributor.authorSahayanathan, B.-
dc.contributor.authorMunasinghe, A.N.T.S.-
dc.contributor.authorUthayakumar, D.-
dc.contributor.authorRupasinghe, L.-
dc.contributor.authorSenarathne, A.-
dc.date.accessioned2022-03-14T08:04:41Z-
dc.date.available2022-03-14T08:04:41Z-
dc.date.issued2019-12-05-
dc.identifier.isbn978-1-7281-4170-1/19-
dc.identifier.urihttp://rda.sliit.lk/handle/123456789/1607-
dc.description.abstractIn the present, memory forensics has captured the world’s attention. Currently, the volatility framework is used to extract artifacts from the memory dump, and the extracted artifacts are then used to investigate and to identify the malicious processes in the memory dump. The investigation process must be conducted manually, since the volatility framework provides only the artifacts that exist in the memory dump. In this paper, we investigate the four predominant domains of registry, DLL, API calls and network connections in memory forensics to implement the system ‘Malfore,’ which helps automate the entire process of memory forensics. We use the cuckoo sandbox to analyze malware samples and to obtain memory dumps and volatility frameworks to extract artifacts from the memory dump. The finalized dataset was evaluated using several machine learning algorithms, including RNN. The highest accuracy achieved was 98%, and it was reached using a recurrent neural network model, fitted to the data extracted from the DLL artifacts, and 92% accuracy was reached using a recurrent neural network model,fitted to data extracted from the network connection artifacts.en_US
dc.language.isoenen_US
dc.publisher2019 1st International Conference on Advancements in Computing (ICAC), SLIITen_US
dc.relation.ispartofseriesVol.1;-
dc.subjectMemory forensicsen_US
dc.subjectmalwareen_US
dc.subjectcuckoo sandboxen_US
dc.subjectvolatilityen_US
dc.subjectmachine learningen_US
dc.subjectdeep learningen_US
dc.subjectfeature selectionen_US
dc.titleAn Automated Tool for Memory Forensicsen_US
dc.typeArticleen_US
dc.identifier.doi10.1109/ICAC49085.2019.9103416en_US
Appears in Collections:1st International Conference on Advancements in Computing (ICAC) | 2019
Department of Computer Systems Engineering-Scopes

Files in This Item:
File Description SizeFormat 
An_Automated_Tool_for_Memory_Forensics.pdf
  Until 2050-12-31
545.52 kBAdobe PDFView/Open Request a copy


Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.