Memory forensics using virtual machine introspection for Malware analysis
Journal
2017 IEEE Conference on Dependable and Secure Computing
Pages
518-519
Date Issued
2017
Author(s)
Abstract
A security sandbox is a technology that is often used to detect advanced malware. However, current sandboxes are highly dependent on VM hypervisor types and versions. Thus, in this paper, we introduce a new sandbox design, using memory forensics techniques, to provide an agentless sandbox solution that is independent of the VM hypervisor. In particular, we leverage the VM introspection method to monitor malware running memory data outside the VM and analyze its system behaviors, such as process, file, registry, and network activities. We evaluate the feasibility of this method using 20 advanced and 8 script-based malware samples. We furthermore demonstrate how to analyze malware behavior from memory and verify the results with three different sandbox types. The results show that we can analyze suspicious malware activities, which is also helpful for cyber security defense. © 2017 IEEE.
Subjects
Advanced malware analysis; Cyber security; Security sandbox; Virtual machine introspection
SDGs
Other Subjects
Computer crime; Network security; Virtual machine; Cyber security; ITS systems; Malware analysis; Malware behaviors; Memory forensics; Network activities; Security sandbox; Virtual machine introspection; Malware
Type
conference paper