ISSN 1000-1239 CN 11-1777/TP

计算机研究与发展 ›› 2018, Vol. 55 ›› Issue (10): 2278-2290.doi: 10.7544/issn1000-1239.2018.20180405

所属专题: 2018分布式安全与区块链技术研究专题

• 信息安全 • 上一篇    下一篇

一种基于隐藏事件触发机制的内存取证方法

崔超远1,李勇钢1,2,乌云3,王励成4   

  1. 1(中国科学院合肥物质科学研究院合肥智能机械研究所 合肥 230031);2(中国科学技术大学研究生院科学岛分院 合肥 230027);3(中国科学院合肥物质科学研究院应用技术研究所 合肥 230088);4(北京邮电大学网络空间安全学院 北京 100876) (cycui@iim.ac.cn)
  • 出版日期: 2018-10-01
  • 基金资助: 
    国家重点研发计划项目(2018YFD0700302);中国科学院STS计划项目(KFJ-STS-ZDTP-004)

A Memory Forensic Method Based on Hidden Event Trigger Mechanism

Cui Chaoyuan1, Li Yonggang1,2, Wu Yun3, Wang Licheng4   

  1. 1(Institute of Intelligent Machines, Hefei Institutes of Physical Science, Chinese Academy of Sciences, Hefei 230031);2(Graduate School of Science Island Branch, University of Science and Technology of China, Hefei 230027);3(Institute of Applied Technology, Hefei Institutes of Physical Science, Chinese Academy of Sciences, Hefei 230088);4(School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876)
  • Online: 2018-10-01

摘要: 内存取证是计算机取证科学的重要分支,能够提取和分析操作系统运行状态的数字证据,已经成为对抗网络犯罪的有力武器.现有内存取证方法大多是全面获取内存数据,因而包含大量冗余信息,为后续内存分析带来不便.此外,在取证时间点选取方面存在盲目性,尤其是对具有隐藏特性的恶意软件,无法准确地在攻击发生时进行实时取证.由于内存具有易失性和不可恢复性的特点,取证时间点与攻击过程不匹配将使得取证内容无法表征攻击行为,导致取证数据无效.针对以上问题,提出一种基于隐藏事件触发机制的内存取证方法ForenHD.该方法利用虚拟化技术实时监视目标虚拟机中的内核对象,并通过分析内核对象的逻辑连接关系和运行状态的变化来检测隐藏对象;然后以隐藏对象的发现作为内存取证的触发事件,通过内存映射提取隐藏对象的代码段信息,实现实时和局部内存取证.通过对多种隐藏对象取证的实验,证明了ForenHD的可行性和有效性.

关键词: 内存取证, 实时取证, 局部取证, 隐藏事件, 触发机制, 系统虚拟化技术

Abstract: As an important branch of computer forensics, memory forensics can extract and alalyze digital evidence of OS running status, and has become a powerful weapon against cybercrimes. Most of the existed memory forensics approaches obtain memory data completely, and thus contain a large amount of redundant information, which brings inconvenience to subsequent memory analysis. In addition, there is blindness in the selection of forensic time points, especially for malware with hidden characteristics, so it cannot accurately perform real-time forensics when an attack occurs. Because of the volatile and unrecoverable nature of memory, the mismatch between the forensic time point and the attack process will make the forensic content unable to characterize the attack behavior, resulting in invalid forensic data. This study proposes ForenHD, a memory forensics approach based on hidden event trigger mechanism. ForenHD monitors the kernel objects in the target virtual machine in real time by leveraging virtualization technology. It firstly determines hidden objects by analyzing the logical connection and running status of kernel objects, and then uses the discovered hidden objects as the triggering event of memory forensics. Finally ForenHD extracts the code segment information of the hidden object through memory mapping. As a result, real-time and partial memory forensics can be achieved. Experiments on multiple hidden object forensics show ForenHDs feasibility and effectiveness.

Key words: memory forensic, real-time forensic, partial forensics, hidden event, trigger mechanism, system virtualization technology

中图分类号: