The Experts below are selected from a list of 9 Experts worldwide ranked by ideXlab platform
Tianjie Cao - One of the best experts on this subject based on the ideXlab platform.
-
Memory Forensics for QQ from a Live System
2015Co-Authors: Yuhang Gao, Tianjie CaoAbstract:Abstract—Our paper details the techniques to collect sensitive information of the QQ client, which is the most popular instant messaging (IM) in China. We have managed to acquire the contact list, the QQ account, the chats records, the QQ discussion group, the display names and the contents of network notepad. They are of great interest to the examiners. Besides, as the techniques we use to search for process are able to reveal terminated and hidden processes, we are very likely to find sensitive information as long as somebody has logged in the QQ client. What’s more, we propose the method of reconstructing the process space by integrating paging File into Memory Dump File. We have reconstructed the process space of the QQ client in this way and managed to narrow down the scale of sensitive information about QQ. Index Terms—instant messaging; the QQ client; memor
-
Linux Memory Forensics: Searching For Processes
2011Co-Authors: Yuhang Gao, Tianjie CaoAbstract:Abstract—Physical Memory is a useful information source in a forensic examination, but the research on Memory forensics is still in the early stage. Once the processes are located, computer forensic personnel can acquire the opened Files, the network connections via further processing. This paper proposed methods of searching for process descriptors in Linux Dump File. Our experiments shows that our methods are able to locate hidden, terminated and even processes before rebooted under some circumstances. An analysis of performance between different methods is made and results show the brute force method find the most while method based on slub allocator is highly efficient. Besides, our experiments shows a process survives from minutes to hours after it is terminated in Linux 2.6.23 and slub allocation obviously has an impact on Memory forensics. These methods proposed to searching for processes not only can apply to Linux Memory forensics in locating hidden, exiting processes, but also can be of interest to the malware analyzing. Keywords-Memory Dump File; Linux Memory analysis; digital evidences; File extraction 1
Yuhang Gao - One of the best experts on this subject based on the ideXlab platform.
-
Memory Forensics for QQ from a Live System
2015Co-Authors: Yuhang Gao, Tianjie CaoAbstract:Abstract—Our paper details the techniques to collect sensitive information of the QQ client, which is the most popular instant messaging (IM) in China. We have managed to acquire the contact list, the QQ account, the chats records, the QQ discussion group, the display names and the contents of network notepad. They are of great interest to the examiners. Besides, as the techniques we use to search for process are able to reveal terminated and hidden processes, we are very likely to find sensitive information as long as somebody has logged in the QQ client. What’s more, we propose the method of reconstructing the process space by integrating paging File into Memory Dump File. We have reconstructed the process space of the QQ client in this way and managed to narrow down the scale of sensitive information about QQ. Index Terms—instant messaging; the QQ client; memor
-
Linux Memory Forensics: Searching For Processes
2011Co-Authors: Yuhang Gao, Tianjie CaoAbstract:Abstract—Physical Memory is a useful information source in a forensic examination, but the research on Memory forensics is still in the early stage. Once the processes are located, computer forensic personnel can acquire the opened Files, the network connections via further processing. This paper proposed methods of searching for process descriptors in Linux Dump File. Our experiments shows that our methods are able to locate hidden, terminated and even processes before rebooted under some circumstances. An analysis of performance between different methods is made and results show the brute force method find the most while method based on slub allocator is highly efficient. Besides, our experiments shows a process survives from minutes to hours after it is terminated in Linux 2.6.23 and slub allocation obviously has an impact on Memory forensics. These methods proposed to searching for processes not only can apply to Linux Memory forensics in locating hidden, exiting processes, but also can be of interest to the malware analyzing. Keywords-Memory Dump File; Linux Memory analysis; digital evidences; File extraction 1
Yekui Qian - One of the best experts on this subject based on the ideXlab platform.
-
a malware classification method based on Memory Dump grayscale image
Digital Investigation, 2018Co-Authors: Yusheng Dai, Yekui QianAbstract:Abstract Effective analysis of malware is of great significance in guaranteeing the reliability of the system operation. Malware can easily escape from existing dynamic analysis methods. Aiming at the deficiencies of current methods for detecting malware dynamically, a method of using hardware features is proposed, namely, a Memory Dump File is extracted and converted into a grayscale image, the image is converted into a fixed size, and the image feature is extracted using histogram of gradient, and the currently popular classifier algorithm is used to classify malware. Experiments are conducted using actual malware samples and the effectiveness of using Memory Dump File image is verified. This method is superior to the recently proposed hardware performance counter detection method.
Yusheng Dai - One of the best experts on this subject based on the ideXlab platform.
-
a malware classification method based on Memory Dump grayscale image
Digital Investigation, 2018Co-Authors: Yusheng Dai, Yekui QianAbstract:Abstract Effective analysis of malware is of great significance in guaranteeing the reliability of the system operation. Malware can easily escape from existing dynamic analysis methods. Aiming at the deficiencies of current methods for detecting malware dynamically, a method of using hardware features is proposed, namely, a Memory Dump File is extracted and converted into a grayscale image, the image is converted into a fixed size, and the image feature is extracted using histogram of gradient, and the currently popular classifier algorithm is used to classify malware. Experiments are conducted using actual malware samples and the effectiveness of using Memory Dump File image is verified. This method is superior to the recently proposed hardware performance counter detection method.