# The Evolution of Volatile Memory Forensics
## 4 Memory Analysis
### Discussion  
Each of the many varied tools used to analyze volatile memory have strengths and weaknesses, and some offer fundamentally different approaches to the problem. Table 2 summarizes the features of these tools and shows how they have evolved over the last decade. Although dynamic analysis and machine learning are arguably better approaches to malware detection, signature scanning remains a mainstay in how industry antivirus companies provide protection to their customers. Signature scanning is established, fast, and it reliably identifies the majority of security threats that their customers face. However, it is incapable of identifying new threats. Machine learning-based approaches, although widely talked about, have yet to be widely used in industry. This is at least partially due to the quality of the datasets on which these methods have been tested and the lack of replication of results. In the machine learning approaches reviewed in this survey, all of the datasets used contained a limited number of samples from a few benign and malicious families. While the development for a large publicly available datasets of memory dump images is already underway [46] and will surely aid with this issue, in general, machine learning-based methods still need to be verified on larger, more diverse, and more realistic datasets. However, once larger datasets are used, researchers are likely to run into time complexity issues that often accompany large machine learning models. Secondly, some of the research regarding ML methods reviewed here did not provide enough implementation details to replicate similar results. Providing enough details for replication, or even better, making code bases publicly available, will aid in establishing machine learning as a reliable method for malware detection in volatile memory forensics. Eventually, the publication of trained machine learning models, or transfer learning, as is done in the natural language processing and image recognition spaces, could result in more participation and innovation from those researchers who lack the necessary resources to train large ML models and store the data.  
\begin{table}
\begin{tabular}{l l l l l l l l l} \hline \hline
**Tool Name** & **First Author** & **Year** & **Sandbox Analysis** & **Scanning Method** & **ML Method** & **Utilizes Volatility** & **Live Detection** & **Automated** \\ \hline  & [PERSON] & 2012 & x & & & & x & \\ \hline YARA & & 2013 & & x & & & x \\ \hline  & [PERSON] & 2014 & & & x & x & & \\ \hline AMAL & [PERSON] & 2015 & x & x & & & x \\ \hline  & [PERSON] & 2017 & x & & & x & x & \\ \hline  & [PERSON] & 2017 & & x & & x & & x \\ \hline  & [PERSON] & 2017 & & x & & & & x \\ \hline  & [PERSON] & 2017 & & & x & & x & x \\ \hline \hline \end{tabular}
\end{table}
Table 2: A visual summary of the non-commercial volatile memory analysis tools. Ordered by the year the tool was released, we see the increasing popularity of ML methods. We also notice that the use of _Volatility_ and sandboxing methods is well established. Interestingly, very few tools are capable of live malware detection.