About | Contact Us | Register | Login
ProceedingsSeriesJournalsSearchEAI
Digital Forensics and Cyber Crime. 10th International EAI Conference, ICDF2C 2018, New Orleans, LA, USA, September 10–12, 2018, Proceedings

Research Article

On Efficiency and Effectiveness of Linear Function Detection Approaches for Memory Carving

Download(Requires a free EAI acccount)
280 downloads
Cite
BibTeX Plain Text
  • @INPROCEEDINGS{10.1007/978-3-030-05487-8_1,
        author={Lorenz Liebler and Harald Baier},
        title={On Efficiency and Effectiveness of Linear Function Detection Approaches for Memory Carving},
        proceedings={Digital Forensics and Cyber Crime. 10th International EAI Conference, ICDF2C 2018, New Orleans, LA, USA, September 10--12, 2018, Proceedings},
        proceedings_a={ICDF2C},
        year={2019},
        month={1},
        keywords={Memory forensics Carving Disassembly Binary analysis},
        doi={10.1007/978-3-030-05487-8_1}
    }
    
  • Lorenz Liebler
    Harald Baier
    Year: 2019
    On Efficiency and Effectiveness of Linear Function Detection Approaches for Memory Carving
    ICDF2C
    Springer
    DOI: 10.1007/978-3-030-05487-8_1
Lorenz Liebler1,*, Harald Baier1,*
  • 1: University of Applied Sciences
*Contact email: lorenz.liebler@h-da.de, harald.baier@h-da.de

Abstract

In the field of unstructured memory analysis, the context-unaware detection of function boundaries leads to meaningful insights. For instance, in the field of binary analysis, those structures yield further inference, e.g., identifying binaries known to be bad. However, recent publications discuss different strategies for the problem of function boundary detection and consider it to be a difficult problem. One of the reasons is that the detection process depends on a quantity of parameters including the used architecture, programming language and compiler parameters. Initially a typical memory carving approach transfers the paradigm of signature-based detection techniques from the mass storage analysis to memory analysis. To automate and generalise the signature matching, signature-based recognition approaches have been extended by machine learning algorithms. Recently a review of function detection approaches claims that the results are possibly biased by large portions of shared code between the used samples. In this work we reassess the application of recently discussed machine learning based function detection approaches. We analyse current approaches in the context of memory carving with respect to both their efficiency and their effectiveness. We show the capabilities of function start identification by reducing the features to vectorised mnemonics. In all this leads to a significant reduction of runtime by keeping a high value of accuracy and a good value of recall.

Keywords
Memory forensics Carving Disassembly Binary analysis
Published
2019-01-04
Appears in
SpringerLink
http://dx.doi.org/10.1007/978-3-030-05487-8_1
Copyright © 2018–2025 ICST
EBSCOProQuestDBLPDOAJPortico
EAI Logo

About EAI

  • Who We Are
  • Leadership
  • Research Areas
  • Partners
  • Media Center

Community

  • Membership
  • Conference
  • Recognition
  • Sponsor Us

Publish with EAI

  • Publishing
  • Journals
  • Proceedings
  • Books
  • EUDL