DeepMemIntrospect: Recognizing Data Structures in Memory with Neural Networks

Abstract

One yet-to-be-solved but very vital memory forensic problem is to recover data structure information from a specified memory range. Unlike previous studies relying on fixed signature of value or structure, DeepMemIntrospect is the first convolution neural network (CNN) based memory forensic system that can recover data structure information merely from raw memory without relying on signatures. Our experimental results demonstrate high accuracy with over 99% and also show significant performance improvement.