CRII: SaTC: GEMINI: Guided Execution Based Mobile Advanced Persistent Threat Investigation

高级持续性威胁（APT）活动越来越多地针对企业、政府和金融机构部署的移动设备。不幸的是，即使是高调的APT攻击也反应迟缓，这表明当局缺乏快速调查正在进行的攻击的能力（在几个小时或几天而不是几个月的时间内）。为了应对这一挑战，本研究从内存图像取证的最新发展（特别是最近引入的一种称为引导执行的技术）中获得灵感，该技术提供了目前APT调查中无与伦比的快速证据收集和犯罪调查能力。这项研究正在开发一个名为GEMINI的综合框架，它将现代记忆取证的目标从调查现实世界的犯罪转移到APT活动上。在怀疑发生攻击后，仅对从Android设备收集的单个内存映像进行分析，GEMINI就提供了以下一套APT调查能力：(1)基于探索性引导执行技术，GEMINI可以搜索并重新创建先前制定的APT攻击阶段。(2)除了调查先前的攻击执行情况外，GEMINI还可以通过“木偶操纵”预先阶段的记忆图像数据来揭示隐藏的/潜在的未来攻击行为。(3)在探索未来的有效载荷后，GEMINI可以进一步利用其引导执行能力来修复观察到的攻击策略。这项工作通过推进研究和开发针对移动设备的APT活动的调查技术，直接为国家安全做出贡献。此外，这项研究的结果是公开的，目的是加强发现和授权未来的研究在这一领域，以及有助于开发新的课程材料集中在恶意软件分析和逆向工程。

Advanced persistent threat (APT) campaigns are increasingly targeting mobile devices deployed across corporations, governments, and financial institutions. Unfortunately, prohibitively slow responses to even high-profile APT attacks have shown that authorities lack the capability to quickly investigate ongoing attacks (in a matter of hours or days rather than months). To address this challenge, this research draws inspiration from recent developments in memory image forensics (in particular a recently introduced technique called guided execution), which has provided rapid evidence collection and crime investigation capabilities currently unparalleled in APT investigation. This research is developing an integrated framework, called GEMINI, which shifts the goal of modern memory forensics from the investigation of physical-world crimes to APT campaigns. Based on the analysis of only a single memory image --- collected from an Android device after an attack is suspected --- GEMINI provides the following set of APT investigation capabilities: (1) Based on exploratory guided execution techniques, GEMINI can search for and re-create previously enacted APT attack stages. (2) Beyond investigating prior attack execution, GEMINI enables the revelation of hidden/potential future attack behaviors by 'puppeteering' their executing with pre-staged memory image data. (3) After exploring future payloads, GEMINI can further leverage its guided execution capabilities for the remediation of the observed attack strategies.This work directly contributes to national security by advancing research in and developing techniques for the investigation of APT campaigns targeting mobile devices. In addition, the results of this research are being made publicly available with the goal of enhancing discovery and empowering future research in this area as well as contributing to the development of new curriculum materials focused on malware analysis and reverse engineering.