CRII: SaTC: Leveraging Userland In-Memory Objects for Cybercrime Investigations and Malware Classification

在移动的设备上，应用程序开发的先进性和复杂性以及许多用户每天对其功能的极大依赖使其成为数字调查的关键证据。该项目的重点是应用程序执行的重建，以恢复移动的设备上的用户和指纹恶意软件活动。该研究将为调查人员提供一种方法，轻松概述用户操作和策略，以及可能的恶意软件攻击蓝图，而无需事先了解目标应用程序逻辑。该项目将通过吸引本科生和研究生参与内存取证研究来进一步推进数字取证能力。通过利用内存中的工件进行执行重建和恶意软件分类，该项目开发了用于调查Android应用程序的应用程序不可知内存取证实用程序。该解决方案将从剩余的内存中用户态数据对象及其元数据重新创建程序执行切片，然后将它们映射到从进程内存的代码部分恢复的加载图像，以确定生成用户活动的确切组件和程序流。这种技术的优点是它为调查人员提供了一个清晰的程序流程图，显示了一系列用户事件和所涉及的数据。新重构的存储器内程序切片和加载的图像文件然后将进一步用作多模态学习恶意软件分类方案中的两个不同模态的输入特征向量。这些独特的功能共同代表了应用程序的功能和代码结构，当应用于多模式算法时，将产生更强大和更有弹性的恶意软件指纹，可以高度准确地检测相似和混淆的变体。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

On mobile devices, the advancement and sophistication in application development and the great reliance on their functionality daily by many users makes them a critical piece of evidence for digital investigations. This project focuses on the reconstruction of app execution to recover user and fingerprint malware activities on mobile devices. The research will provide a methodology for investigators to easily outline user actions and strategies, and possible malware attack blueprint without the need for prior knowledge of the target application logic. This project will further advance digital forensics capabilities, by engaging both undergraduate and graduate students in memory forensics research.By leveraging in-memory artifacts for execution reconstruction and malware classification, this project develops app-agnostic memory forensics utilities for investigating Android applications. The solution will recreate program execution slices from residual in-memory userland data objects and their metadata and then map them to the loaded images recovered from the code section of the process memory to determine the exact components and program flows that generated the user's activity. The advantage of this technique is it gives the investigator a clear picture of the program flow path, showing a sequence of user events and the data involved. The newly reconstructed in-memory program slices and loaded image files will then further serve as input feature vectors to two distinct modalities in a multimodal learning malware classification scheme. These unique features which together represent app functionality and code structure when applied in the multimodal algorithm will result in a more robust and resilient malware fingerprint that can detect similar and obfuscated variants with a high degree of accuracy.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.