<div dir="ltr"><div>We have a gentle reminder and little update regarding our group meeting. We are going to meet at 2 PM at MSE201. <span class="gmail-il">Wei</span> Song will present his CCS'18 paper in today's meeting. Hang will present his ongoing project sometimes later. Sorry for last minutes changes.</div><div><br>The title of his paper is: "DeepMem: Learning Graph Neural Network Models for Fast and Robust Memory Forensic Analysis". <br><br></div><div dir="ltr"><b><br></b></div><div dir="ltr"><div dir="ltr"><b>ABSTRACT</b></div><div dir="ltr">Kernel data structure detection is an important task in memory forensics that aims at identifying semantically important kernel data structures from raw memory dumps. It is primarily used to collect evidence of malicious or criminal behaviors. Existing approaches have several limitations: 1) list-traversal approaches are vulnerable to DKOM attacks, 2) robust signature-based approaches are not scalable or efficient, because it needs to search the entire memory snapshot for one kind of objects using one signature, and 3) both list-traversal and signature-based approaches all heavily rely on domain knowledge of operating system. Based on the limitations, we propose DeepMem, a graph-based deep learning approach to automatically generate abstract representations for kernel objects, with which we could recognize the objects from raw memory dumps in a fast and robust way. Specifically, we implement 1) a novel memory graph model that reconstructs the content and topology information of memory dumps, 2) a graph neural network architecture to embed the nodes in the memory graph, and 3) an object detection method that cross-validates the evidence collected from different parts of objects. Experiments show that DeepMem achieves high precision and recall rate in identify kernel objects from raw memory dumps. Also, the detection strategy is fast and scalable by using the intermediate memory graph representation. Moreover, DeepMem is robust against attack scenarios, like pool tag manipulation and DKOM process hiding.<br><br><br><br></div></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr" style="font-size:12.8px"><div dir="ltr"><div dir="ltr"><div>Regards,</div><div><br></div><div>Md Lutfor Rahman</div><div>Ph.D. Candidate</div><div>Department of Computer Science & Engineering</div><div>University of California, Riverside </div><div>Cell: 205 413 6573</div><div>Email: <a href="mailto:mrahm011@ucr.edu" target="_blank">mrahm011@ucr.edu</a></div><div>Webpage: <a href="http://www.cs.ucr.edu/~mrahm011/" target="_blank">http://www.cs.ucr.edu/~mrahm011/</a></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Oct 16, 2018 at 5:30 PM Md Lutfor Rahman <<a href="mailto:mrahm011@ucr.edu">mrahm011@ucr.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Correction: Hang will be tomorrow's presenter. Sorry for this inconvenience.<br><br clear="all"><div><div dir="ltr" class="m_-6496661298351201852gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr" style="font-size:12.8px"><div dir="ltr"><div dir="ltr"><div>Regards,</div><div><br></div><div>Md Lutfor Rahman</div><div>Ph.D. Candidate</div><div>Department of Computer Science & Engineering</div><div>University of California, Riverside </div><div>Cell: 205 413 6573</div><div>Email: <a href="mailto:mrahm011@ucr.edu" target="_blank">mrahm011@ucr.edu</a></div><div>Webpage: <a href="http://www.cs.ucr.edu/~mrahm011/" target="_blank">http://www.cs.ucr.edu/~mrahm011/</a></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Oct 16, 2018 at 5:05 PM Md Lutfor Rahman <<a href="mailto:mrahm011@ucr.edu" target="_blank">mrahm011@ucr.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi All,<br><br>This is just a gentle reminder.<br><br><span style="color:rgb(51,51,51);font-family:"Open Sans",Arial">We have our security group meeting tomorrow from 2-3PM at MSE 201.</span><br style="color:rgb(51,51,51);font-family:"Open Sans",Arial"><span style="font-family:"Fira Sans",Arial;color:rgb(67,78,87)">Pengxiong Zhu will present on the topics</span><span style="font-family:Arial"> "Towards automatic test harness generation for fuzzing".</span><span style="color:rgb(51,51,51);font-family:"Open Sans",Arial"><br></span><div><font color="#333333" face="Open Sans, Arial"><span style="font-size:13.3333px"><br></span></font></div><div><a href="https://docs.google.com/spreadsheets/d/1V4hsBpPkS0AMCe78932ZBVpaendnc3n1cpEZRgfDsJQ/edit#gid=0" style="font-family:"Open Sans",Arial;font-size:13.3333px" target="_blank">https://docs.google.com/spreadsheets/d/1V4hsBpPkS0AMCe78932ZBVpaendnc3n1cpEZRgfDsJQ/edit#gid=0</a><font color="#333333" face="Open Sans, Arial"><span style="font-size:13.3333px"><br><br><br clear="all"></span></font><div><div dir="ltr" class="m_-6496661298351201852m_-2394935415962432131gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr" style="font-size:12.8px"><div dir="ltr"><div dir="ltr"><div>Regards,</div><div><br></div><div>Md Lutfor Rahman</div><div>Ph.D. Candidate</div><div>Department of Computer Science & Engineering</div><div>University of California, Riverside </div><div>Cell: 205 413 6573</div><div>Email: <a href="mailto:mrahm011@ucr.edu" target="_blank">mrahm011@ucr.edu</a></div><div>Webpage: <a href="http://www.cs.ucr.edu/~mrahm011/" target="_blank">http://www.cs.ucr.edu/~mrahm011/</a></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</blockquote></div>
</blockquote></div>