چكيده به لاتين
Abstract:
The goal of this thesis is to detect rootkits which hide themselves and their associated malwares in main memory using direct kernel object modification techniques. Memory forensics is used to find hidden processes of rootkits in memory. Hidden processes can be detected either according to information of operating systems or based on signature of processes during scanning memory. The main problem in this procedure is unreliability of data obtained from kernel operating system which is manipulated by malware and make mentioned methods ineffective. To solve this problem, we need a signature which not only has high precision in finding processes in memory but also be robust to manipulation of malwares. So, structure of about five thousand processes extracted from memory image of running systems and stored as process’s structure dataset. Then dataset has been analyzed and common bits between processes have been gained. Innovation of this research is in presenting “Combinational Dynamic Bit Signature” which is built by adding signature of related headers to basic process structure. To adapt signature with new processes, a threshold has been defined for every part of combinational signature due to part’s size. Evaluations show that provided signature can find all process structures in memory image faster than other methods, while applying threshold to signature make it to find manipulated processes too. In the other hand, due to producing the signature automatically and independent to process structure’s content, this method can be used to produce other kernel object’s signatures in other versions of operating system.
Keywords: Memory Forensics, Memory Analysis, Rootkit, hidden process detection, DKOM attacks detection
