Work

MemCatcher: An In-Depth Analysis Approach to Detect In-Memory Malware

Year: 2025

Type: article

Abstract: Recent advancements in cyber threats have led to increasingly sophisticated attack methods that evade traditional malware detection systems. In-memory malware, a particularly challenging variant, operates by modifying volatile memory, leaving minimal traces on secondary storage. This paper presents an in-depth analysis of in-memory malware characteristics, behavior, and evasion strategies. We propose “MemCatcher”, a novel detection algorithm that integrates real-time system activity monitoring and memory analysis to effectively identify these threats from the Windows 10 system. Experimental validation using real-world and synthetic in-memory malware samples demonstrates the effectiveness of our approach. Additionally, we analyze evasion tactics using “Volatility3” and “PEview”, providing insights into countermeasures. Future work will focus on enhancing in-memory malware detection using “Processor-in-Memory (PIM) hardware”.

Source: Applied Sciences

DOI: 10.3390/app152111800

Authors: Andri Rai, Eul Im

Institution: Hanyang University

Language: English

Topic: Advanced Malware Detection Techniques

Subfield: Signal Processing

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $2,896

Funders: National Research Foundation, Ministry of Science and ICT, South Korea, Institute for Information and Communications Technology Promotion