Tipped Off by Your Memory Allocator: Device-Wide User Activity Sequencing from Android Memory Images
Tipped Off by Your Memory Allocator: Device-Wide User Activity Sequencing from Android Memory Images
复制标题
内存分配器提示：根据 Android 内存映像对设备范围内的用户活动进行排序
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
G. Richard
中科院分区：
文献类型：
--
作者：
R. Bhatia;Brendan Saltaformaggio;S. Yang;Aisha I. Ali;X. Zhang;Dongyan Xu;G. Richard
一项基本的法医能力是推断犯罪嫌疑人在犯罪过程中的行动顺序。不幸的是，对于网络调查来说，用户活动时间轴重建仍然是一个开放的研究挑战，目前需要手动识别可数据工件/日志和基于启发式的时间推断。在本文中，我们提出了一个内存取证能力，以解决这一挑战。我们提出了Timeliner，一种取证技术，能够自动推断的时间轴的Android设备上的所有应用程序的用户操作，从一个单一的内存图像从设备中获取。Timeliner的灵感来自于Android应用程序Activity启动会留下关键的自我识别数据结构。更重要的是，这些数据结构的集合可以按时间排序，这是因为它们在内存中的分配和分布是可预测的。基于这些观察，Timeliner被设计为（1）识别和恢复这些残留数据结构，（2）推断其对应的Activity之间的用户引起的转换，以及（3）重建设备范围的跨应用程序Activity时间轴。Timeliner旨在利用Android集中式ActivityManager服务的内存映像。因此，它能够在所有应用程序中对Activity启动进行排序-即使是那些已终止的应用程序。我们的评估表明，Timeliner可以在不同Android平台上的各种应用程序中揭示大量证据（长达一小时）。
An essential forensic capability is to infer the sequence of actions performed by a suspect in the commission of a crime. Unfortunately, for cyber investigations, user activity timeline reconstruction remains an open research challenge, currently requiring manual identification of datable artifacts/logs and heuristic-based temporal inference. In this paper, we propose a memory forensics capability to address this challenge. We present Timeliner, a forensics technique capable of automatically inferring the timeline of user actions on an Android device across all apps, from a single memory image acquired from the device. Timeliner is inspired by the observation that Android app Activity launches leave behind key self-identifying data structures. More importantly, this collection of data structures can be temporally ordered, owing to the predictable manner in which they were allocated and distributed in memory. Based on these observations, Timeliner is designed to (1) identify and recover these residual data structures, (2) infer the user-induced transitions between their corresponding Activities, and (3) reconstruct the devicewide, cross-app Activity timeline. Timeliner is designed to leverage the memory image of Android’s centralized ActivityManager service. Hence, it is able to sequence Activity launches across all apps — even those which have terminated. Our evaluation shows that Timeliner can reveal substantial evidence (up to an hour) across a variety of apps on different Android platforms.