The Experts below are selected from a list of 307650 Experts worldwide ranked by ideXlab platform

Shuhui Zhang - One of the best experts on this subject based on the ideXlab platform.

  • ICPCSEE (1) - Research on Linux Kernel Version Diversity for Precise Memory Analysis
    Communications in Computer and Information Science, 2017
    Co-Authors: Shuhui Zhang, Xiangxu Meng, Lianhai Wang, Guangqi Liu
    Abstract:

    The diversity of Linux versions brings challenges to Linux Memory Analysis, which is an established technique in security and forensic investigations. During Memory forensics, kernel data structures are essential information. Existing solutions obtain this information by analyzing debugging information or by decompiling kernel functions to handle a certain range of versions. In this paper, by collecting and analyzing a number of Linux versions, we characterize the properties of different Linux kernel versions and how struct offsets change between versions. Furthermore, the Linux kernel provides over 10,000 configurable features, which leads to different kernel structure layouts for the same kernel version. To deal with this problem, we propose a method of identifying kernel struct layout based on brute-force matching. By examining the relationships between kernel structures, common features are extracted and exploited for brute-force matching. The experimental results show that the proposed technology can deduce structure member offsets accurately and efficiently.

  • Research on Linux Kernel Version Diversity for Precise Memory Analysis
    Data Science, 2017
    Co-Authors: Shuhui Zhang, Xiangxu Meng, Lianhai Wang, Guangqi Liu
    Abstract:

    The diversity of Linux versions brings challenges to Linux Memory Analysis, which is an established technique in security and forensic investigations. During Memory forensics, kernel data structures are essential information. Existing solutions obtain this information by analyzing debugging information or by decompiling kernel functions to handle a certain range of versions. In this paper, by collecting and analyzing a number of Linux versions, we characterize the properties of different Linux kernel versions and how struct offsets change between versions. Furthermore, the Linux kernel provides over 10,000 configurable features, which leads to different kernel structure layouts for the same kernel version. To deal with this problem, we propose a method of identifying kernel struct layout based on brute-force matching. By examining the relationships between kernel structures, common features are extracted and exploited for brute-force matching. The experimental results show that the proposed technology can deduce structure member offsets accurately and efficiently.

  • An adaptive approach for Linux Memory Analysis based on kernel code reconstruction
    EURASIP Journal on Information Security, 2016
    Co-Authors: Shuhui Zhang, Xiangxu Meng, Lianhai Wang
    Abstract:

    Memory forensics plays an important role in security and forensic investigations. Hence, numerous studies have investigated Windows Memory forensics, and considerable progress has been made. In contrast, research on Linux Memory forensics is relatively sparse, and the current knowledge does not meet the requirements of forensic investigators. Existing solutions are not especially sophisticated, and their complicated operation and limited treatment range are unsatisfactory. This paper describes an adaptive approach for Linux Memory Analysis that can automatically identify the kernel version and recovery symbol information from an image. In particular, given a Memory image or a Memory snapshot without any additional information, the proposed technique can automatically reconstruct the kernel code, identify the kernel version, recover symbol table files, and extract live system information. Experimental results indicate that our method runs satisfactorily across a wide range of operating system versions.

  • Virtual Machine Security Monitoring Method Based on Physical Memory Analysis
    Wireless Communications Networking and Applications, 2015
    Co-Authors: Shumian Yang, Liang Ge, Lianhai Wang, Shuhui Zhang
    Abstract:

    In the cloud computing environment, the security of virtual machine system becomes increasingly important with virtual machines have been widely deployed. Virtual machine security monitoring method based on physical Memory Analysis is proposed allusion to security risk and criminal behavior in the current cloud computing, computer, and mobile information terminal. Cloud security monitoring forensics system is developed based on the monitoring method, which can get each virtual host “Memory” in physical hosts without affecting the user experience and the running state of virtual machines. The forensic system can fast access to the critical information through Memory Analysis, such as process information, thread information, network information, registry information, opened file information, and can further in-depth Analysis and mine the virtual machine hard disk information. It can achieve comprehensive monitoring, forensics evidence, Analysis and processing, and efficiently obtain evidence of a crime in the cloud. The method has been verified on KVM and VMware Workstation and is proved to be effective and reliable. Finally, it gives the deficiencies of the research work and the next work.

  • Exploratory study on Memory Analysis of Windows CE device
    2013 Fourth International Conference on Intelligent Control and Information Processing (ICICIP), 2013
    Co-Authors: Shumian Yang, Lianhai Wang, Shuhui Zhang
    Abstract:

    In the field of forensic Analysis, Windows CE devices are a real issue for an IT security expert. Memory acquisition and Analysis is a weight in Windows CE devices forensic. The paper introduces physical Memory acquisition and Analysis methods of the different versions in Windows environment and the importance and procedure of Memory Analysis which is different of Windows CE device. We develop tentatively windows CE device Memory Analysis tools based on the idea of computer Memory Analysis and put forward the physical Memory Analysis method of windows CE device. This paper analyzes the in-Memory structures which represent the currently system running processes, threads, mail client username and landed site. The method is verified on Windows Mobile 6.5 operating system and proved reliably and efficiently.

Lianhai Wang - One of the best experts on this subject based on the ideXlab platform.

  • ICPCSEE (1) - Research on Linux Kernel Version Diversity for Precise Memory Analysis
    Communications in Computer and Information Science, 2017
    Co-Authors: Shuhui Zhang, Xiangxu Meng, Lianhai Wang, Guangqi Liu
    Abstract:

    The diversity of Linux versions brings challenges to Linux Memory Analysis, which is an established technique in security and forensic investigations. During Memory forensics, kernel data structures are essential information. Existing solutions obtain this information by analyzing debugging information or by decompiling kernel functions to handle a certain range of versions. In this paper, by collecting and analyzing a number of Linux versions, we characterize the properties of different Linux kernel versions and how struct offsets change between versions. Furthermore, the Linux kernel provides over 10,000 configurable features, which leads to different kernel structure layouts for the same kernel version. To deal with this problem, we propose a method of identifying kernel struct layout based on brute-force matching. By examining the relationships between kernel structures, common features are extracted and exploited for brute-force matching. The experimental results show that the proposed technology can deduce structure member offsets accurately and efficiently.

  • Research on Linux Kernel Version Diversity for Precise Memory Analysis
    Data Science, 2017
    Co-Authors: Shuhui Zhang, Xiangxu Meng, Lianhai Wang, Guangqi Liu
    Abstract:

    The diversity of Linux versions brings challenges to Linux Memory Analysis, which is an established technique in security and forensic investigations. During Memory forensics, kernel data structures are essential information. Existing solutions obtain this information by analyzing debugging information or by decompiling kernel functions to handle a certain range of versions. In this paper, by collecting and analyzing a number of Linux versions, we characterize the properties of different Linux kernel versions and how struct offsets change between versions. Furthermore, the Linux kernel provides over 10,000 configurable features, which leads to different kernel structure layouts for the same kernel version. To deal with this problem, we propose a method of identifying kernel struct layout based on brute-force matching. By examining the relationships between kernel structures, common features are extracted and exploited for brute-force matching. The experimental results show that the proposed technology can deduce structure member offsets accurately and efficiently.

  • An APT Trojans Detection Method for Cloud Computing Based on Memory Analysis and FCM
    2016 3rd International Conference on Information Science and Control Engineering (ICISCE), 2016
    Co-Authors: Liang Ge, Lianhai Wang, Lijuan Xu
    Abstract:

    With Memory information as characteristic, a classified method to detect APT (Advanced Persistent Threat)Trojans in cloud computing is proposed in this paper. Memory Analysis and fuzzy C-means (FCM) algorithm based on the optimized initial cluster centers detects the similarity of the APT Trojans. Without influence normal operation of virtual machine in cloud, the classifier can determine whether it is malware or not. The method can overcome the shortage of feature scanning technology which could not recognize unknown Trojans, and could significantly improve the detection speed since it does not need to unpack, decrypt, and other complex operations. Experiment results show that the detection method has good accuracy, so there is a certain practical value.

  • An adaptive approach for Linux Memory Analysis based on kernel code reconstruction
    EURASIP Journal on Information Security, 2016
    Co-Authors: Shuhui Zhang, Xiangxu Meng, Lianhai Wang
    Abstract:

    Memory forensics plays an important role in security and forensic investigations. Hence, numerous studies have investigated Windows Memory forensics, and considerable progress has been made. In contrast, research on Linux Memory forensics is relatively sparse, and the current knowledge does not meet the requirements of forensic investigators. Existing solutions are not especially sophisticated, and their complicated operation and limited treatment range are unsatisfactory. This paper describes an adaptive approach for Linux Memory Analysis that can automatically identify the kernel version and recovery symbol information from an image. In particular, given a Memory image or a Memory snapshot without any additional information, the proposed technique can automatically reconstruct the kernel code, identify the kernel version, recover symbol table files, and extract live system information. Experimental results indicate that our method runs satisfactorily across a wide range of operating system versions.

  • Virtual Machine Security Monitoring Method Based on Physical Memory Analysis
    Wireless Communications Networking and Applications, 2015
    Co-Authors: Shumian Yang, Liang Ge, Lianhai Wang, Shuhui Zhang
    Abstract:

    In the cloud computing environment, the security of virtual machine system becomes increasingly important with virtual machines have been widely deployed. Virtual machine security monitoring method based on physical Memory Analysis is proposed allusion to security risk and criminal behavior in the current cloud computing, computer, and mobile information terminal. Cloud security monitoring forensics system is developed based on the monitoring method, which can get each virtual host “Memory” in physical hosts without affecting the user experience and the running state of virtual machines. The forensic system can fast access to the critical information through Memory Analysis, such as process information, thread information, network information, registry information, opened file information, and can further in-depth Analysis and mine the virtual machine hard disk information. It can achieve comprehensive monitoring, forensics evidence, Analysis and processing, and efficiently obtain evidence of a crime in the cloud. The method has been verified on KVM and VMware Workstation and is proved to be effective and reliable. Finally, it gives the deficiencies of the research work and the next work.

Gilbert L. Peterson - One of the best experts on this subject based on the ideXlab platform.

  • Windows driver Memory Analysis: A reverse engineering methodology
    Computers & Security, 2011
    Co-Authors: James S. Okolica, Gilbert L. Peterson
    Abstract:

    In a digital forensics examination, the capture and Analysis of volatile data provides significant information on the state of the computer at the time of seizure. Memory Analysis is a premier method of discovering volatile digital forensic information. While much work has been done in extracting forensic artifacts from Windows kernel structures, less focus has been paid to extracting information from Windows drivers. There are two reasons for this: (1) source code for one version of the Windows kernel (but not associated drivers) is available for educational use and (2) drivers are generally called asynchronously and contain no exported functions. Therefore, finding the handful of driver functions of interest out of the thousands of candidates makes reverse code engineering problematic at best. Developing a methodology to minimize the effort of analyzing these drivers, finding the functions of interest, and extracting the data structures of interest is highly desirable. This paper provides two contributions. First, it describes a general methodology for reverse code engineering of Windows drivers Memory structures. Second it applies the methodology to tcpip.sys, a Windows driver that controls network connectivity. The result is the extraction from tcpip.sys of the data structures needed to determine current network connections and listeners from the 32 and 64 bit versions of Windows Vista and Windows 7. Manipulation (DKOM), tcpip.sys, Windows 7, Windows Vista. 2000 MSC: 60, 490.

  • Windows operating systems agnostic Memory Analysis
    Digital Investigation, 2010
    Co-Authors: James S. Okolica, Gilbert L. Peterson
    Abstract:

    Memory Analysis is an integral part of any computer forensic investigation, providing access to volatile data not found on a drive image. While Memory Analysis has recently made significant progress, it is still hampered by hard-coded tools that cannot generalize beyond the specific operating system and version they were developed for. This paper proposes using the debug structures embedded in Memory dumps and Microsoft's program database (PDB) files to create a flexible tool that takes an arbitrary Memory dump from any of the family of Windows NT operating systems and extract process, configuration, and network activity information. The debug structures and PDB files are incorporated into a Memory Analysis tool and tested against dumps from 32-bit Windows XP with physical address extensions (PAE) enabled and disabled, 32-bit Windows Vista with PAE enabled, and 64-bit Windows 7 systems. The results show the Analysis tool is able to identify and parse an arbitrary Memory dump and extract process, registry, and network communication information.

  • IFIP Int. Conf. Digital Forensics - A Compiled Memory Analysis Tool
    Advances in Digital Forensics VI, 2010
    Co-Authors: James S. Okolica, Gilbert L. Peterson
    Abstract:

    The Analysis of computer Memory is becoming increasingly important in digital forensic investigations. Volatile Memory Analysis can provide valuable indicators on what to search for on a hard drive, help recover passwords to encrypted hard drives and possibly refute defense claims that criminal activity was the result of a malware infection. Historically, digital forensic investigators have performed live response by executing multiple utilities. However, using a single tool to capture and analyze computer Memory is more efficient and has less impact on the system state (potential evidence). This paper describes CMAT, a self-contained tool that extracts forensic information from a Memory dump and presents it in a format that is suitable for further Analysis. A comparison of the results obtained with utilities that are commonly employed in live response demonstrates that CMAT provides similar information and identifies malware that is missed by the utilities.

Lianggee Chen - One of the best experts on this subject based on the ideXlab platform.

  • Memory Analysis of vlsi architecture for 5 3 and 1 3 motion compensated temporal filtering video coding applications
    International Conference on Acoustics Speech and Signal Processing, 2005
    Co-Authors: Chaotsung Huang, Chingyeh Chen, Yihau Chen, Lianggee Chen
    Abstract:

    To the best of authors' knowledge, this paper presents the first work on Memory Analysis of VLSI architectures for motion-compensated temporal filtering (MCTF). The open-loop MCTF prediction scheme has led the revolution for hybrid video coding methods that are mainly based on the close-loop MC prediction (MCP) scheme, and it also becomes the core technology of the coming video coding standard, MPEG-21 part 13-scalable video coding (SVC). In this paper, the macroblock (MB)-level and frame-level data reuse schemes are analyzed for the MCTF. The MB-level data reuse is especially for the motion estimation (ME), and the level C+ scheme is proposed, which can further reduce the Memory bandwidth of the conventional level C scheme. Frame-level data reuse schemes for MCTF are proposed according to the open-loop prediction nature.

  • ICASSP (5) - Memory Analysis of VLSI architecture for 5/3 and 1/3 motion-compensated temporal filtering [video coding applications]
    Proceedings. (ICASSP '05). IEEE International Conference on Acoustics Speech and Signal Processing 2005., 1
    Co-Authors: Chaotsung Huang, Chingyeh Chen, Yihau Chen, Lianggee Chen
    Abstract:

    To the best of authors' knowledge, this paper presents the first work on Memory Analysis of VLSI architectures for motion-compensated temporal filtering (MCTF). The open-loop MCTF prediction scheme has led the revolution for hybrid video coding methods that are mainly based on the close-loop MC prediction (MCP) scheme, and it also becomes the core technology of the coming video coding standard, MPEG-21 part 13-scalable video coding (SVC). In this paper, the macroblock (MB)-level and frame-level data reuse schemes are analyzed for the MCTF. The MB-level data reuse is especially for the motion estimation (ME), and the level C+ scheme is proposed, which can further reduce the Memory bandwidth of the conventional level C scheme. Frame-level data reuse schemes for MCTF are proposed according to the open-loop prediction nature.

Jesse D Kornblum - One of the best experts on this subject based on the ideXlab platform.

  • Using Every Part of the Buffalo in Windows Memory Analysis ∗ Abstract
    2008
    Co-Authors: Jesse D Kornblum
    Abstract:

    All Windows Memory Analysis techniques depend on the examiner’s ability to translate the virtual addresses used by programs and operating system components into the true locations of data in a Memory image. In some Memory images up to 20 % of all the virtual addresses in use point to so called “invalid ” pages that cannot be found using a naive method for address translation. This paper explains virtual address translation, enumerates the different states of invalid Memory pages, and presents a more robust strategy for address translation. This new method incorporates invalid pages and even the paging file to greatly increase the completeness of the Analysis. By using every available page, every part of the buffalo as it were, the examiner can more accurately recreate the state of the machine as it existed at the time of imaging

  • using every part of the buffalo in windows Memory Analysis
    Digital Investigation, 2007
    Co-Authors: Jesse D Kornblum
    Abstract:

    All Windows Memory Analysis techniques depend on the examiner's ability to translate the virtual addresses used by programs and operating system components into the true locations of data in a Memory image. In some Memory images up to 20% of all the virtual addresses in use point to so called ''invalid'' pages that cannot be found using a naive method for address translation. This paper explains virtual address translation, enumerates the different states of invalid Memory pages, and presents a more robust strategy for address translation. This new method incorporates invalid pages and even the paging file to greatly increase the completeness of the Analysis. By using every available page, every part of the buffalo as it were, the examiner can better recreate the state of the machine as it existed at the time of imaging.

  • Exploiting the Rootkit Paradox with Windows Memory Analysis
    International Journal of Digital Evidence, 2006
    Co-Authors: Jesse D Kornblum
    Abstract:

    Rootkits are malicious programs that silently subvert an operating system to hide an intruder's activities. Although there are a number of tools designed to detect rootkits, these programs are competing with the rootkit for system resources and allowing the rootkit to actively evade detection. By taking a Memory image of the system, a forensic examiner can conduct a more thorough search for rootkits and even without discovering one directly, infer the presence of one. This paper explores how an examiner can create such a Memory image and use the inherent properties of rootkits to find them in those Memory images. Background