## 4 Experiment and Discussion
### Experiment Results and Discussion
\begin{table}
\begin{tabular}{c c c c c c c c c c} \hline
**Sample** & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9** & **Average** \\
**No** & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9** & **Average** \\ \hline MRCIF & 100\% & 100\% & 100\% & 100\% & 100\% & 100\% & 100\% & 100\% & 0 & 88.89\% \\ malfind & 25\% & 33.3\% & 50\% & 0\% & 42.9\% & 96.15\% & 96\% & 50\% & 25\% & 46.48\% \\ malthfind & 0 & 100\% & 50\% & 0\% & 60\% & 100\% & 100\% & 60\% & 60\% \\ \hline Ptemalfind & 3.9\% & 3.9\% & 25\% & 3.9\% & 8.6\% & 89.28\% & 100\% & 100\% & 60\% & 60\% \\ \hline \end{tabular}
\end{table} 
Table 2: Process detection accuracy. Note that in Sample 2 and 3, Reflective DLL will first read the payload DLL file as data directly into the memory during injection, perform this operation again on the memory space, and remap the payload code module in the executable code mode. So, there are two injection modules: one is the file data page, and the other is the executable memory page. Since injected data pages are usually freed, only executable memory pages are counted as detection target pages in the accuracy rate. As shown in Tables 2 and 3, the malfind method only detects the private attributes and protection attributes of VAD nodes, but the detection conditions are rough, which results in low accuracy. The malthfind method discovers unknown calling modules by reconstructing the call stack. It has high accuracy in detecting malicious injected pages, such as samples 2, 5, 6, and 7, but it cannot detect potential injected pages that are not executed. As for samples 3 and 4, some of the injected pages are not executed, and there is no stack, so the malthfind method cannot detect these pages. In samples 3 and 6, malthfind fails to rebuild the stack on Windows10 because of the lack of the necessary objects in Volatility profile. Ptemalfind only achieved slightly better results in the experiment of Windows10, such as Sample 3 and 6. It cannot run on samples 5, 6, and 7 because the PTE structure of the WinXP lacks the properties required for Ptemalfind detection. Meanwhile, this method can detect almost all the memory pages injected by the method, but its accuracy is extremely low, which makes it difficult to apply in practice. In comparison, MRCIF can completely detect the hidden injected pages for samples 1-8 without false positives. Especially in sample 4, only MRCIF can detect the injected code module with high accuracy. The memory structures used in MRCIF, such as EPROCESS, LDR linked list, and PTE, are all necessary structures provided in Microsoft PDB files. Therefore, compared with malthfind and Ptemalfind, MRCIF is more widely applicable in different versions of Windows with higher accuracy. For sample 9, Coreflood's injection code module erases the PE header, while MRCIF is characterized by the PE header, so the hidden injection page cannot be detected at all. In terms of time consumption (as shown in Table 4), MRCIF consumes the most time in all the methods. This is due to the translation of all virtual addresses of all processes. Because the detection process is not real-time, the time consumption should be worthwhile. Moreover, the translation of all virtual addresses can be executed in parallel by the process to improve the efficiency of hardware usage, but we have not realized it at present, which is our future work.