DeepMem
DeepMem is a graph-based deep learning tool that automatically generates abstract representations for kernel objects, and recognizes the objects from raw memory dumps in a fast and robust way.
Specifically, we implement 1) a memory graph model that reconstructs the content and topology information of memory dumps, 2) a graph neural network architecture to embed the nodes in the memory graph, and 3) an object detection method that cross-validates the evidence collected from different parts of objects.
Reference
The paper of this project can be found at DeepMem. If you use this code for academic purposes, please cite it as:
@inproceedings{song2018deepmem,
title={DeepMem: Learning Graph Neural Network Models for Fast and Robust Memory Forensic Analysis},
author={Song, Wei and Yin, Heng and Liu, Chang and Song, Dawn},
booktitle={Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security},
pages={606--618},
year={2018},
organization={ACM}
}
How to use it?
1. Set up the environment
Python
Version 2.6 or 2.7, but not 3.0.
apt-get install pcregrep libpcre++-dev python-dev python -y
Distorm3
python -m pip install distorm3
More information: https://github.com/gdabah/distorm
PyCrypto
pip install pycrypto
More information: https://pypi.org/project/pycrypto/
TensorFlow
pip install tensorflow==1.3.0
2. Get memory dumps
Download the memory dumps used in our experiment from: https://drive.google.com/drive/u/1/folders/1SB-20rZPmSYWUo96ZjN7ue88IzBY01V8.
Create a folder memory_dumps/ in root directory of this project, and move all memory dumps to that folder.
Or you can create your memory dumps using our tool: https://github.com/bitsecurerlab/vm_mem_dump_tool.git.
3. Create memory graphs
cd create_memory_graphs/
python create_memory_graphs.py
4. Train the model
cd build_model
python train_model.py --obj_type _ETHREAD
Currently, we support 6 kernel objects: _EPROCESS, _ETHREAD, _DRIVER_OBJECT, _FILE_OBJECT, _LDR_DATA_TABLE_ENTRY, _CM_KEY_BODY.
During training, the script will save the current model to the build_model/model/ directory after every 100 iterations.
You may stop the training when the precision and recall is good enough for that kernel object.
5. Testing the model
cd build_model
python test_model.py --obj_type _ETHREAD --model_path model/_ETHREAD/20190705_142745/struct2vec_edge_type.HOP3._ETHREAD-10000