26 A Review of “Pre-processing Memory Dumps to Improve Similarity Score of Windows Modules”
Memory forensics is useful to provide a fast triage on running processes at the time of memory acquisition in order to avoid unnecessary forensic analysis. However due to the efects of the execution of the process itself, traditional cryptographic hashes are insuitable in memory forensics. Similarit...
| Autores: | , , |
|---|---|
| Tipo de recurso: | capítulo de libro |
| Fecha de publicación: | 2021 |
| País: | España |
| Institución: | Universidad de Castilla-La Mancha |
| Repositorio: | RUIdeRA. Repositorio Institucional de la UCLM |
| OAI Identifier: | oai:ruidera.uclm.es:10578/28632 |
| Acceso en línea: | http://doi.org/10.18239/jornadas_2021.34.26 http://hdl.handle.net/10578/28632 |
| Access Level: | acceso abierto |
| Palabra clave: | similarity digest algorithms memory forensics Windows relocation |
| Sumario: | Memory forensics is useful to provide a fast triage on running processes at the time of memory acquisition in order to avoid unnecessary forensic analysis. However due to the efects of the execution of the process itself, traditional cryptographic hashes are insuitable in memory forensics. Similarity digest algorithms allow an analyst to compute a similarity score of inputs that can be slightly di erent. In this paper, we focus on the issues caused by relocation of Windows processes and system libraries when computing similarities between them. To overcome these ssues, we introduce two methods (Guided de-relocation and lineas sweep de-relocation) to pre-process a memory dump. The goal of both methods is to identify and undo the efect of relocation in every module contained in the dump, providing sanitized inputs to similarity digest algorithms that improve similarity scores between modules. Guided de-relocation relies on specific structures of the Windows PE format, while Linear Sweep De-relocation relies on a disassembling process to identify assembly instructions having memory operands that address the memory range of the module. We have evaluated them in diferent scenarios. Our results demonstrate that pre-processing memory dumps with these methods significantly improves similarity scores between memory modules. In addition, both methods have been integrated in a Volatility plugin. |
|---|