CRII: SaTC: Leveraging Userland In-Memory Objects for Cybercrime Investigations and Malware Classification

在移动设备上，应用程序开发的先进性和复杂性，以及许多用户每天对其功能的高度依赖，使其成为数字调查的关键证据。该项目专注于应用程序执行的重建，以恢复移动设备上的用户和指纹恶意软件活动。这项研究将为调查人员提供一种方法，以便轻松概述用户操作和策略，以及可能的恶意软件攻击蓝图，而不需要事先了解目标应用程序逻辑。该项目将通过让本科生和研究生参与内存取证研究，进一步提升数字取证能力。通过利用内存中的人工制品进行执行重建和恶意软件分类，该项目开发与应用程序无关的内存取证实用程序，用于调查Android应用程序。该解决方案将从剩余的内存中用户数据对象及其元数据重新创建程序执行切片，然后将它们映射到从进程内存的代码段恢复的加载图像，以确定生成用户活动的确切组件和程序流。这项技术的优势在于，它为调查人员提供了程序流程的清晰图景，显示了用户事件的顺序和涉及的数据。然后，新重构的内存中程序切片和加载的图像文件将进一步用作多模式学习恶意软件分类方案中的两个不同模式的输入特征向量。这些独特的功能共同代表了应用程序的功能和代码结构，当应用于多模式算法时，将产生更强大和更具弹性的恶意软件指纹，可以高度准确地检测类似和混淆的变体。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

On mobile devices, the advancement and sophistication in application development and the great reliance on their functionality daily by many users makes them a critical piece of evidence for digital investigations. This project focuses on the reconstruction of app execution to recover user and fingerprint malware activities on mobile devices. The research will provide a methodology for investigators to easily outline user actions and strategies, and possible malware attack blueprint without the need for prior knowledge of the target application logic. This project will further advance digital forensics capabilities, by engaging both undergraduate and graduate students in memory forensics research.By leveraging in-memory artifacts for execution reconstruction and malware classification, this project develops app-agnostic memory forensics utilities for investigating Android applications. The solution will recreate program execution slices from residual in-memory userland data objects and their metadata and then map them to the loaded images recovered from the code section of the process memory to determine the exact components and program flows that generated the user's activity. The advantage of this technique is it gives the investigator a clear picture of the program flow path, showing a sequence of user events and the data involved. The newly reconstructed in-memory program slices and loaded image files will then further serve as input feature vectors to two distinct modalities in a multimodal learning malware classification scheme. These unique features which together represent app functionality and code structure when applied in the multimodal algorithm will result in a more robust and resilient malware fingerprint that can detect similar and obfuscated variants with a high degree of accuracy.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.