Code signature verification method based on computer memory evidence obtaining technology

Abstract

The invention relates to a code signature verification method based on a computer memory evidence obtaining technology. The method comprises the steps of firstly establishing a dump file for a computer physical memory; then, obtaining an operating system version and configuration file information by utilizing a Volativity evidence obtaining framework; identifying a portable executable (PE) file of a memory under the support of an operating system version and configuration file information; and if the identified PE file contains the digital certificate, verifying the certificate. According to the memory code signature verification method, the code signature in the memory can be effectively verified, and evidence obtaining analysts are assisted in verifying the reliability of PE files in the memory.

Description

Technical field: [0001] The invention relates to a code signature verification method based on computer memory forensics technology. The method has good application in the field of computer memory forensics, and is mainly used for reconstructing security events and detecting untrustworthy files in the memory. Background technique: [0002] Computer forensics technology is a basic step in network security emergency response. Abnormal or unauthorized operations performed by malware in a computer system can be detected by analyzing the system's disk drive or memory. As a branch of computer forensics, memory forensics refers to finding, extracting, and analyzing volatile evidence from computer physical memory and page swap files. The method is to obtain memory dump files through hardware interface acquisition, software acquisition, and virtual machine snapshots. Save it to disk and analyze it using specialized software such as the Volatility Framework to reconstruct relevant sec...

AI Technical Summary

Problems solved by technology

However, there are also some weaknesses in the use of code signing, such as lack of protection on the client side, poor management of secret keys by publishers, certificate authorities issuing certificates to shell companies, etc.

Although code signatures are used to execute malware in computers, there are only a few, but there are still documented incidents such as Stuxnet, megacortex, etc.

Images