Inception: Virtual Space in Memory Space in Real Space – Memory Forensics of Immersive Virtual Reality with the HTC Vive
Inception: Virtual Space in Memory Space in Real Space – Memory Forensics of Immersive Virtual Reality with the HTC Vive
复制标题
《盗梦空间》：真实空间中的内存空间中的虚拟空间 — 使用 HTC Vive 进行沉浸式虚拟现实的内存取证
DOI：
10.1016/j.diin.2019.04.007
复制
发表时间：
2019
影响因子：
--
通讯作者：
Breitinger, Frank
中科院分区：
文献类型：
--
作者：
Casey, Peter;Lindsay-Decusati, Rebecca;Baggili, Ibrahim;Breitinger, Frank
虚拟现实（VR）已经成为现实。随着该技术用例的增加，它的误用也随之而来。影响虚拟环境（VE）的恶意软件可能会阻止调查人员从物理场景或传统的“死亡”分析中确定虚拟信息。随着反取证的趋势，攻击的证据可能只能在内存中找到，以及许多其他不稳定的数据点。我们的工作为沉浸式VR系统，特别是HTC Vive的内存取证提供了主要的解释。我们的方法能够从记忆中重建与虚拟现实相关的人工制品，也能够重建VR玩家沉浸其中的房间设置的可视化。具体来说，我们证明了VR设备的VE、位置、状态和类别可以从内存中提取出来。我们的工作产生了波动性框架的第一个开源VR内存取证插件。我们讨论了我们的发现，以及我们在未来记忆取证研究中可能使用的可复制方法。
Virtual Reality (VR) has become a reality. With the technology's increased use cases, comes its misuse. Malware affecting the Virtual Environment (VE) may prevent an investigator from ascertaining virtual information from a physical scene, or from traditional “dead” analysis. Following the trend of antiforensics, evidence of an attack may only be found in memory, along with many other volatile data points. Our work provides the primary account for the memory forensics of Immersive VR systems, and in specific the HTC Vive. Our approach is capable of reconstituting artifacts from memory that are relevant to the VE, and is also capable of reconstructing a visualization of the room setup a VR player was immersed into. In specific, we demonstrate that the VE, location, state and class of VR devices can be extracted from memory. Our work resulted in the first open source VR memory forensics plugin for the Volatility Framework. We discuss our findings, and our replicable approach that may be used in future memory forensics research.