TY - THES A1 - Fellicious, Christofer T1 - Bridging the gap: Applying machine learning techniques in digital forensics N2 - With the increasing adoption of virtualization technologies across various industries, virtual machines (VMs) offer cost-effective solutions for obtaining computing power without the burden of initial investment or ongoing maintenance. However, the widespread use of VMs also increases the risk of malicious actors attempting to gain unauthorized access due to the possibility of accessing the VMs via standard internet protocols. Virtual Machine Introspection (VMI) and Forensic Memory Analysis (FMA) are two key cybersecurity methods for addressing these threats. While FMA leverages digital forensic techniques to extract and analyse information from system memory to explain security incidents, VMI typically works with live systems, analysing running processes to detect real-time threats. Both approaches face a significant challenge known as the ”semantic gap,” which arises from the need to infer high-level system information from low-level data such as physical memory and CPU registers. This dissertation explores using machine learning to bridge the semantic gap in FMA and VMI applications. The research uses OpenSSH process heap dumps as a use-case to extract high-level structures, such as OpenSSH encryption keys, from raw process memory dumps. The study employs various techniques to isolate relevant memory sections, from basic memory chunking and entropy analysis to more advanced methods utilizing pointers and malloc headers. During this research study, we also identified the need for a foundation model in memory forensics. Foundation models are general purpose models trained on large amounts of data and users can later use these models to perform different tasks by finetuning the model. This research also addresses the challenge of detecting malware by analysing system-level API calls and employing custom feature engineering techniques. Given that the threat landscape is constantly evolving, we also investigate concept drift — a phenomenon where input data distribution changes affect predictive models’ performance. To mitigate the degradation in performance due to concept drift, we introduce a concept drift detection algorithm complemented by a custom sampling method that optimizes training data selection. This approach reduces the training dataset size by one-third, enhancing the efficiency of model training while maintaining high performance. KW - semantic gap KW - virtual machine introspection KW - forensic memory analysis Y1 - 2025 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:bvb:739-opus4-18473 ER -