Digital Forensics and Cyber Crime. 10th International EAI Conference, ICDF2C 2018, New Orleans, LA, USA, September 10–12, 2018, Proceedings

Research Article

On Efficiency and Effectiveness of Linear Function Detection Approaches for Memory Carving

Download
225 downloads
  • @INPROCEEDINGS{10.1007/978-3-030-05487-8_1,
        author={Lorenz Liebler and Harald Baier},
        title={On Efficiency and Effectiveness of Linear Function Detection Approaches for Memory Carving},
        proceedings={Digital Forensics and Cyber Crime. 10th International EAI Conference, ICDF2C 2018, New Orleans, LA, USA, September 10--12, 2018, Proceedings},
        proceedings_a={ICDF2C},
        year={2019},
        month={1},
        keywords={Memory forensics Carving Disassembly Binary analysis},
        doi={10.1007/978-3-030-05487-8_1}
    }
    
  • Lorenz Liebler
    Harald Baier
    Year: 2019
    On Efficiency and Effectiveness of Linear Function Detection Approaches for Memory Carving
    ICDF2C
    Springer
    DOI: 10.1007/978-3-030-05487-8_1
Lorenz Liebler1,*, Harald Baier1,*
  • 1: University of Applied Sciences
*Contact email: lorenz.liebler@h-da.de, harald.baier@h-da.de

Abstract

In the field of unstructured memory analysis, the context-unaware detection of function boundaries leads to meaningful insights. For instance, in the field of binary analysis, those structures yield further inference, e.g., identifying binaries known to be bad. However, recent publications discuss different strategies for the problem of function boundary detection and consider it to be a difficult problem. One of the reasons is that the detection process depends on a quantity of parameters including the used architecture, programming language and compiler parameters. Initially a typical memory carving approach transfers the paradigm of signature-based detection techniques from the mass storage analysis to memory analysis. To automate and generalise the signature matching, signature-based recognition approaches have been extended by machine learning algorithms. Recently a review of function detection approaches claims that the results are possibly biased by large portions of shared code between the used samples. In this work we reassess the application of recently discussed machine learning based function detection approaches. We analyse current approaches in the context of memory carving with respect to both their efficiency and their effectiveness. We show the capabilities of function start identification by reducing the features to vectorised mnemonics. In all this leads to a significant reduction of runtime by keeping a high value of accuracy and a good value of recall.