App-Agnostic Post-Execution Semantic Analysis of Android In-Memory Forensics Artifacts
App-Agnostic Post-Execution Semantic Analysis of Android In-Memory Forensics Artifacts
复制标题
DOI：
10.1145/3427228.3427244
复制
发表时间：
2020-12
期刊：
影响因子：
--
通讯作者：
Aisha I. Ali-Gombe;Alexandra Tambaoan;Angela Gurfolino;G. Richard
中科院分区：
文献类型：
--
作者：
Aisha I. Ali-Gombe;Alexandra Tambaoan;Angela Gurfolino;G. Richard
在过去的十年中，用户态内存取证技术和算法在从业者中越来越受欢迎，因为它们已被证明在真实的取证和网络犯罪调查中非常有用。这些技术分析和恢复对象和文物从进程内存空间是至关重要的调查。尽管如此，现有技术的主要缺点是，它们不能确定恢复的对象存在于其中的起源和上下文，而没有应用程序逻辑的先验知识。因此，在这项研究中，我们提出了一个解决方案，以缩小特定于应用程序和应用程序通用技术之间的差距。我们介绍OAGen，一个执行后和应用程序无关的语义分析方法，旨在帮助调查人员建立具体的证据，通过识别的起源和内存中的对象之间的关系，在一个进程内存图像。OAGen利用指向分析来重构运行时的对象分配网络。然后将生成的图作为输入输入到我们的语义分析算法中，以确定对象在网络中的起源、上下文和范围。我们的实验结果表明，OAGen的能力，有效地创建一个分配网络，即使是内存密集型的应用程序与成千上万的对象，如Facebook。我们的方法在14个不同的Android应用程序上的性能评估表明，OAGen可以有效地搜索和解码节点，并以适度的吞吐率识别它们的引用。OAGen在两个案例研究中的进一步实际应用表明，我们的方法可以帮助调查人员在执行后的程序分析中恢复已删除的消息和检测恶意软件功能。
Over the last decade, userland memory forensics techniques and algorithms have gained popularity among practitioners, as they have proven to be useful in real forensics and cybercrime investigations. These techniques analyze and recover objects and artifacts from process memory space that are of critical importance in investigations. Nonetheless, the major drawback of existing techniques is that they cannot determine the origin and context within which the recovered object exists without prior knowledge of the application logic. Thus, in this research, we present a solution to close the gap between application-specific and application-generic techniques. We introduce OAGen, a post-execution and app-agnostic semantic analysis approach designed to help investigators establish concrete evidence by identifying the provenance and relationships between in-memory objects in a process memory image. OAGen utilizes Points-to analysis to reconstruct a runtime’s object allocation network. The resulting graph is then fed as an input into our semantic analysis algorithms to determine objects’ origin, context, and scope in the network. The results of our experiments exhibit OAGen’s ability to effectively create an allocation network even for memory-intensive applications with thousands of objects, like Facebook. The performance evaluation of our approach across fourteen different Android apps shows OAGen can efficiently search and decode nodes, and identify their references with a modest throughput rate. Further practical application of OAGen demonstrated in two case studies shows that our approach can aid investigators in the recovery of deleted messages and the detection of malware functionality in post-execution program analysis.