Short Malware Forensics to Analyze Intrusions
Stephan Neuhaus
Progress in Machines and Systems, Vol. 13, No. 1, 2024.
DOI: https://doi.org/10.6025/pms/2024/13/1/1-3
Link: https://www.dline.info/pms/fulltext/v13n1/pmsv13n1_1.pdf
Abstract:
Intrusion detection has been studied extensively from different perspectives in the last three decades. In this paper, we have developed a tool called Malfor (short for MALware FORensics), which avoids some drawbacks in the existing systems by using experimental methods. The proposed system, Malfor, captures events (processes in our case) as the system is running. As soon as a break-in is detected, Malfor uses these events to replay the system partially. By cleverly choosing which events to repeat, we isolate those relevant to the break-in. Thus, this system uses experimental methods to analyse intrusions automatically. It can be used on production systems and is especially suitable for the analysis of targeted attacks.