Advancing Cybersecurity Through Userland Memory Forensics: From Runtime Analysis to Security Applications
Year: 2026
Type: article
Abstract: Memory forensics has become a crucial component of digital investigations, particularly for detecting malware operating solely in system memory. As operating system vendors implemented kernel access restrictions, malware authors shifted to userland malware. However, existing memory forensics techniques have largely focused on kernel-level analysis, leaving userland runtimes insufficiently covered. This dissertation addresses this gap by expanding memory analysis capabilities across two distinct paradigms: interpreted and compiled runtimes. The first phase targets the Python runtime, developing automated recovery techniques that enable several security applications. For malware detection, these techniques extract critical forensic artifacts such as encryption keys and command-and-control configurations. For supply chain security, the dissertation presents MEM-SBOM, a framework that generates a Software Bill of Materials directly from runtime state and performs function-level vulnerability reachability analysis. To assess the robustness of these capabilities under adversarial conditions, the dissertation develops a taxonomy of 68 evasion techniques that exploit Python internals. Since Python is embedded in domain-specific applications such as Ultimaker Cura slicing software, the developed techniques extend into forensic investigation of 3D printing activities through SliceSnap, which recovers design files, G-code instructions, and printer metadata from memory. A complementary machine learning framework classifies G-code as benign or malicious when a reference baseline is unavailable. The second phase targets the Go runtime, presenting the first memory forensics framework to recover function metadata, strings, execution paths, and runtime state from goroutine stacks. Together, these frameworks demonstrate that userland memory forensics generalizes across programming paradigms with broad applicability across security domains.
DOI: 10.25772/qagm-sc94
Author: Ali, Hala
Institution: Virginia Commonwealth University
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7170233747