International Conference on Advancements in Computing [ICAC]

Permanent URI for this communityhttps://rda.sliit.lk/handle/123456789/312

The International Conference on Advancements in Computing (ICAC) is organized by the Faculty of Computing of the Sri Lanka Institute of Information Technology (SLIIT) as an open forum for academics along with industry professionals to present the latest findings and research output and practical deployments in computing.

The primary objective of ICAC is to promote innovative research that addresses real-world challenges and contributes to the social well-being of communities. The conference provides a dynamic platform for researchers from around the world to present groundbreaking findings, exchange ideas, and establish meaningful collaborations.

https://icac.lk

Browse

Filters

20191

Advanced Search

Filter by

Settings

Author: search.filters.author.Rupasinghe, L.Subject: search.filters.subject.cuckoo sandbox

Search Results

Now showing 1 - 1 of 1
  • Thumbnail Image
    PublicationEmbargo
    An Automated Tool for Memory Forensics
    (2019 1st International Conference on Advancements in Computing (ICAC), SLIIT, 2019-12-05) Murthaja, M.; Sahayanathan, B.; Munasinghe, A.N.T.S.; Uthayakumar, D.; Rupasinghe, L.; Senarathne, A.
    In the present, memory forensics has captured the world’s attention. Currently, the volatility framework is used to extract artifacts from the memory dump, and the extracted artifacts are then used to investigate and to identify the malicious processes in the memory dump. The investigation process must be conducted manually, since the volatility framework provides only the artifacts that exist in the memory dump. In this paper, we investigate the four predominant domains of registry, DLL, API calls and network connections in memory forensics to implement the system ‘Malfore,’ which helps automate the entire process of memory forensics. We use the cuckoo sandbox to analyze malware samples and to obtain memory dumps and volatility frameworks to extract artifacts from the memory dump. The finalized dataset was evaluated using several machine learning algorithms, including RNN. The highest accuracy achieved was 98%, and it was reached using a recurrent neural network model, fitted to the data extracted from the DLL artifacts, and 92% accuracy was reached using a recurrent neural network model,fitted to data extracted from the network connection artifacts.