SaTC: CORE: Medium: Robust Memory Forensics Techniques for Userland Malware Analysis

最先进的恶意软件（恶意软件）对军事、企业和民用计算机系统和关键基础设施的威胁越来越大。在过去的十年中，内存取证已经开始为检测和分析恶意软件提供强大的技术，并且在其他方法失败的情况下通常是有效的。内存取证工具必须健壮且值得信赖，因为未能检测到恶意软件感染可能会导致灾难性的后果。该项目正在解决内存取证领域的一些重要研究问题，包括扩大内存取证工具的范围和提高其可靠性，并为调查人员提供更好的机制来评估数字调查的正确性。该项目解决了内存取证中三个重要的研究问题：(1)为内存取证的研究和实践创建一个大型的、多样化的、免费的、现实的数据集；(2)开发一个测试平台，可以自动发现开源和闭源内存取证框架中的错误；(3)开发检测和分析用户空间（而不是内核空间）恶意软件活动的技术。

State-of-the-art malicious software (malware) is increasingly a threat to military, corporate, and civilian computer systems and critical infrastructure. Over the past decade, memory forensics has begun to offer powerful techniques for detecting and analyzing malicious software and is often effective in cases where other methods fail. Memory forensics tools must be robust and trustworthy, because failing to detect a malware infection can have disastrous consequences. This project is addressing a number of important research issues in memory forensics, including expanding the scope and improving the reliability of memory forensics tools and providing investigators with better mechanisms to evaluate the correctness of digital investigations.This project is addressing three important research issues in memory forensics: (1) Creating a large, diverse collection of freely available, realistic data sets for memory forensics research and practice; (2) Developing a testing platform that automatically discovers errors in both open and closed source memory forensics frameworks; and (3) Developing techniques to detect and analyze user-space (rather than kernel-space) malware activity.