Memory forensics tools: a comparative analysis

ABSTRACTABSTRACTAs part of the incident response process, the memory forensics tools extract forensic artifacts and display them. Many memory forensics analysis tools are being developed to address the challenges of modern cybercrimes. Investigations are successful when they have an accurate analysis provided by a memory forensics tool that consumes resources reasonably. This paper presents a comparative analysis of three dominant memory forensics tools: Volatility, Autopsy, and Redline. We consider three malware behaviour scenarios and evaluate the forensics capabilities of these tools in each. We also experimentally measure the CPU and memory consumption of each for memory analysis in other operational states. We find that Volatility provides the most accurate memory analysis. Our measurements show that Redline consumes more CPU resources, and Autopsy needs more memory resources to analyze a memory image file. The results of our investigation will hopefully lead to tool improvement and more informed choices by users.KEYWORDS: Cybersecurityincident responsemalware analysismemory forensics AcknowledgmentsThe authors acknowledge the funding from the National Science and Engineering Research Council of Canada (NSERC) through the discovery grant and Canada Research Chair to Dr. Ghorbani.They would like to express their sincere gratitude to Evan R. Kennedy (Service New Brunswick, Fredericton, NB, Canada) for his helpful suggestions.Disclosure statementNo potential conflict of interest was reported by the author(s).Additional informationFundingThis work was supported by the Natural Sciences and Engineering Research Council of Canada [RGPIN 231074].Notes on contributorsMahdi Daghmehchi Firoozjaei Mahdi Daghmehchi Firoozjaei is an Assistant Professor in the School of Computer Science, University of Windsor, Canada. Prior to this, he was a postdoctoral research fellow at University of New Brunswick, Canada. He received a BSc. degree in Telecommunication Engineering and an MSc. degree in Cryptology. Dr. Firoozjaei did his PhD. in Computer Engineering at Sungkyunkwan University, Korea in 2018. He has 10 years industry experience in telecommunication systems and cybersecurity. He worked for the Telecommunication Company of Iran (TCI), Babol, Iran, as a senior engineer from 2006 to 2014, and a project leader at the Canadian Institute for Cybersecurity (CIC), Fredericton, Canada, from 2018 to 2021. Dr. Firoozjaei led CIC R&D projects in the operational technology (OT) forensics for Siemens Canada, and DNS firewall for CIRA. His research interest focuses on persistent malware analysis, digital forensics, network security, privacy- preserving and blockchain.Arash Habibi Lashkari Arash Habibi Lashkari is a senior member of the IEEE and an Associate Professor in Cybersecurity at York University, Canada. Prior to this, he was an Associate Professor at the Faculty of Computer Science, University of New Brunswick, Canada, and the Research Coordinator of the Canadian Institute for Cybersecurity (CIC). His research focuses on cyber threat modeling and detection, malware analysis, big data security, internet traffic analysis, and cybersecurity dataset generation. Arash Lashkari has over 22 years of teaching experience, spanning several international universities, and was responsible for designing the first cybersecurity Capture the Flag (CTF) competition for post-secondary students in Canada. He has been the recipient of 15 awards at international computer security competitions - including three gold awards - and was recognized as one of Canada’s Top 150 Researchers for 2017. In 2020, Dr. Lashkari was recognized with the University of New Brunswick’s prestigious Teaching Innovation Award for his personally created teaching methodology, the Think-Que-Cussion Method. He is the author of ten published books and more than 110 academic articles on a variety of cybersecurity-related topics and the co-author of the national award-winning article series, ‘Understanding Canadian Cybersecurity Laws’, which was recently recognized with a Gold Medal at the 2020 Canadian Online Publishing Awards.Ali A. Ghorbani Ali A. Ghorbani has held a variety of positions in academia for the past 40 years and is currently a Professor of Computer Science, Tier 1 Canada Research Chair in Cybersecurity, the Director of the Canadian Institute for Cybersecurity, which he established in 2016, and an IBM Canada Faculty Fellow. He served as the Dean of the Faculty of Computer Science at the University of New Brunswick from 2008 to 2017. Dr. Ghorbani is also the founding director of the laboratory for intelligence and adaptive systems research. He has spent over 29 years of his 40-year academic career carrying out both fundamental and applied research in the area of cybersecurity, machine learning, and web intelligence. His current research focus is cybersecurity, Web Intelligence, and Critical Infrastructure Protection. Dr. Ghorbani is the co-inventor on three awarded patents in the area of Network Security and Web Intelligence and has published over 270 peer-reviewed articles during his career. He has supervised over 180 research associates, postdoctoral fellows, graduate, and undergraduate students during his career. His book, Intrusion Detection and Prevention Systems: Concepts and Techniques, was published by Springer in October 2010. Dr. Ghorbani is the co-founder of the Privacy, Security, Trust (PST) Network in Canada and its annual international conference. He has served as General Chair and Program Chair/Co-Chair for 16 International Conferences and Workshops and served as the co-Editor-In-Chief of Computational Intelligence: An International Journal from 2007 to 2017.