Malware Forensics: An Application of Scientific Knowledge to Cyber Attacks

Malware Forensics: An Application of Scientific Knowledge to Cyber Attacks

C. V. Suresh Babu, G. Suruthi, C. Indhumathi
Copyright: © 2023 |Pages: 28
DOI: 10.4018/978-1-6684-8666-5.ch013
OnDemand:
(Individual Chapters)
Available
$37.50
Current Special Offers
No Current Special Offers
TOTAL SAVINGS: $37.50

Abstract

Malware continues to plague all organizations causing data loss and reputational damage. Malware forensics helps protect companies from such attacks. The data is going to be organized in a manner that covers the multiple malware attacks, the methods for detecting them, and then makes a suggestion for a tool that is comparable but also equivalent to reach the attacker. Considering that the concept signifies that malware forensics will be performed using a variety of tools and techniques, a procedure will be followed in order to get the desired outcome. This chapter discusses these issues in detail with an intensive literature review and feasible recommendations and suggestions.
Chapter Preview
Top

1. Introduction

Malware forensics is the practice of investigating malware incidents by examining the evidence left behind. It involves detecting malware through system logs or antivirus software, isolating and containing it to prevent further spread, and then acquiring information about the incident using various tools like hard drive imaging, memory dump analysis, and network traffic capture. The collected evidence is carefully examined to determine the type and extent of the malware attack, including analyzing the malware's code, network behavior, and reverse engineering. The goal is to understand the motives, identify the attackers, and assess the damage caused. Finally, a comprehensive report is generated, summarizing the analysis results, methodologies used, and providing recommendations for future security improvements. Malware forensics is crucial for organizations to learn from past attacks, take appropriate actions, and prevent future incidents.

1.1. Existing Systems

  • ●

    Memory Forensics: One limitation is the loss of network connections and running processes when malware is running in memory, hindering comprehensive analysis.

  • ●

    Machine Learning-based Malware Detection: Hackers develop sophisticated malware to confuse algorithms, requiring collaborative approaches and additional technologies for improved efficiency

  • ●

    Binary Content Comparison for Malware Analysis: Static analysis cannot detect unknown malware types and uses excessive memory resources.

  • ●

    Dynamic Malware Analysis: Existing systems consume significant memory and battery, impacting performance and scalability.

Top

2. Types Of Malwares

2.1. Ransomware

Ransomware, a malicious software program used by cybercriminals, has become a significant threat in the digital realm. It encrypts valuable data, rendering it inaccessible to victims who must then pay a ransom to obtain the decryption key necessary for recovery. Organizations are the primary targets of ransomware attacks. Attackers demand payment in cryptocurrency, typically Bitcoin, through a process involving instructions and a link to purchase the required funds. However, there is no guarantee that paying the ransom will result in the release of the decryption key. Ransomware attacks have seen a substantial increase in frequency since the emergence of the AIDS Trojan in 1989, with 623 million incidents reported in 2021. Small businesses, with weaker security measures, often find themselves compelled to comply with ransom demands. The economic impact of such attacks is severe, threatening countries by extorting exorbitant ransom amounts while holding critical data hostage. Heightened awareness and effective countermeasures are essential for organizations, especially small businesses, to mitigate the impact of ransomware attacks and protect sensitive data (Kaspersky, )[2].

Complete Chapter List

Search this Book:
Reset