An Efficient Approach of Threat Hunting Using Memory Forensics

Abstract

The capacity and occurrence of new cyber-attacks have shattered in recent years. Such measures have very complicated workflows and comprise multiple illegal actors and organizations. Threat hunting demonstrates the process of proactively searching through networks for threats based on zero-day attacks by repeating the hunting process again and again. Unlike threat intelligence, it uses different automated security tools to collect logs in order to provide a pattern for making new intelligence-based tools by following those logs. According to our research findings about “threat hunting tools” there’s a major flaw that the designed tools are limited to the collection of logs. It works completely on logs for generating new patterns avoiding system’s main memory. Codes written directly to memory fail this process to provide proactive hunting. To overcome this major challenge, we are proposing two distinct methods, either by generating malicious code alerts or by binding memory forensics processes with threat hunting tools to make active hunting possible

EEG-Based Epileptic Seizure Detection via Machine/Deep Learning Approaches: A Systematic Review

“…Because of the limitation of knowledge retrievals, the researchers focus on "nonblack-box classifiers, including random forest and decision trees approach. e literature of [104,[129][130][131][132] examined the decision forest and decision tree, and they reported that decision forest classifiers were more effective than implementing a decision tree for its overfitting issues. An algorithm extracts the rules from 86% 88% 90% 90% 91% 91% 92% 92% 93% 94% 95% training data using a decision tree that generates either a limited or a single set of logic rules (for example, whenever C2 entropy value is less than 101.01, class value � seizure) and stops growing the tree by adding more records to the training dataset once the rule is accepted by the algorithm [127].…”

Turning the Hunted into the Hunter via Threat Hunting: Life Cycle, Ecosystem, Challenges and the Great Promise of AI

“…Logs in the memory are an important place to investigate for attacks. Automated security tools formulate logs to organize the patterns used to make new tools [179]. The authors of [179] explained that some design tools are limited in the ways they collect the logs.…”

“…Automated security tools formulate logs to organize the patterns used to make new tools [179]. The authors of [179] explained that some design tools are limited in the ways they collect the logs. To create valuable logs researchers have proposed generating malicious code alerts and binding memory forensic processes for active threat hunting [179].…”

“…The authors of [179] explained that some design tools are limited in the ways they collect the logs. To create valuable logs researchers have proposed generating malicious code alerts and binding memory forensic processes for active threat hunting [179]. The article [179] concludes that these methods will assist in the generation of log memories and only have the malicious entries produce RAM alerts.…”

Man in the Middle Attacks: Analysis, Motivation and Prevention

“…[6]. These ARP spoofing can be sectioned into two rudimentary types namely deceitful the host and deceitful the gateway of the interior network [7]. When a user desires to interconnect with another user belonging to the similar network with unidentified MAC address, it results in a broadcast where ARP request in the network.…”