•  
  •  
 

Publisher

The Association of Digital Forensics, Security and Law (ADFSL)

Abstract

Lossless compression of memory dumps from virtual machines that run malware samples is considered with the goal of significantly reducing archival costs in dynamic-malware-analysis applications. Given that, in such dynamic-analysis scenarios, malware samples are typically run in virtual machines just long enough to activate any self-decryption or other detection- avoidance maneuvers, the virtual-machine memory typically changes little from that of the baseline state, with the difference being attributable in large degree to the loading of additional executables and libraries. Consequently, delta coding is proposed to compress the current virtual-machine memory dump by coding its differences with respect to a predicted memory image formed by loading the same executables and libraries into the baseline memory. Experimental results reveal a significant improvement in compression efficiency as compared to straightforward delta encoding without such predictive executable / library loading.

References

Burrows, M., & Wheeler, D. J. (1994, May). A block-sorting lossless data compression algorithm (Technical Report No. 124). Digital Equipment Corporation.

Egele, M., Scholte, T., Kirda, E., & Kruegel, C. (2012, February). A survey on automatic dynamic malware-analysis techniques and tools. ACM Computing Surveys, 44 (2).

Farmer, D., & Venema, W. (2005). Forensic discovery. Addison-Wesley.

Fowler, J. E. (2000, August). QccPack: An open-source software library for quantization, compression, and coding. In A. G. Tescher (Ed.), Applications of digital image processing xxiii (p. 294- 301). San Diego, CA.

Korn, D. G., MacDonald, J. P., Mogul, J. C., & Vo, K.-P. (2002, June). The VCD- IFF generic differencing and compression data format. RFC 3284.

Ligh, M. H., Case, A., Levy, J., & Walters, A. (2014). The art of memory forensics: Detecting malware and threats in Windows, Linux, and Mac memory. Wiley.

Microsoft. (2013, February). Microsoft portable executable and common object file format specification. (Rev. 8.3)

Ziv, J., & Lempel, A. (1977, May). A universal algorithm for sequential data compression. IEEE Transactions on Information Theory, 23 (3), 337-343.

Ziv, J., & Lempel, A. (1978, September). Compression of individual sequences via variable-rate coding. IEEE Transactions on Information Theory, 24 (5), 530-536.

DOI

https://doi.org/10.15394/jdfsl.2017.1437

 

To view the content in your browser, please download Adobe Reader or, alternately,
you may Download the file to your hard drive.

NOTE: The latest versions of Adobe Reader do not support viewing PDF files within Firefox on Mac OS and if you are using a modern (Intel) Mac, there is no official plugin for viewing PDF files within the browser window.