On the Trustworthiness of Memory Analysis-An Empirical Study from the Perspective of Binary Execution

Aravind Prakash, Eknath Venkataramani, Heng Yin, Zhiqiang Lin

Research output: Contribution to journalArticlepeer-review

11 Scopus citations

Abstract

Memory analysis serves as a foundation for many security applications such as memory forensics, virtual machine introspection and malware investigation. However, malware, or more specifically a kernel rootkit, can often tamper with kernel memory data, putting the trustworthiness of memory analysis under question. With the rapid deployment of cloud computing and increase of cyber attacks, there is a pressing need to systematically study and understand the problem of memory analysis. In particular, without ground truth, the quality of the memory analysis tools widely used for analyzing closed-source operating systems (like Windows) has not been thoroughly studied. Moreover, while it is widely accepted that value manipulation attacks pose a threat to memory analysis, its severity has not been explored and well understood. To answer these questions, we have devised a number of novel analysis techniques including (1) binary level ground-truth collection, and (2) value equivalence set directed field mutation. Our experimental results demonstrate not only that the existing tools are inaccurate even under a non-malicious context, but also that value manipulation attacks are practical and severe. Finally, we show that exploiting information redundancy can be a viable direction to mitigate value manipulation attacks, but checking information equivalence alone is not an ultimate solution.

Original languageEnglish (US)
Article number6942280
Pages (from-to)557-570
Number of pages14
JournalIEEE Transactions on Dependable and Secure Computing
Volume12
Issue number5
DOIs
StatePublished - Sep 1 2015

Keywords

  • DKOM
  • Invasive Software
  • Kernel Rootkit
  • Memory Forensics
  • Operating Systems Security
  • Virtual Machine Introspection

ASJC Scopus subject areas

  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'On the Trustworthiness of Memory Analysis-An Empirical Study from the Perspective of Binary Execution'. Together they form a unique fingerprint.

Cite this