TY - JOUR A1 - Weißgerber, Thomas A1 - Ben Amor, Mehdi A1 - Fellicious, Christofer A1 - Granitzer, Michael T1 - PyPads: Transparent Machine Learning Experiment Tracking JF - Datenbank-Spektrum N2 - Despite algorithmic advancements in the field of machine learning, a need for improvement in the infrastructure supporting machine learning development and research has become increasingly apparent. Machine learning experiments usually tend to be more ad-hoc in nature, and results are communicated most often in the form of a publication. Experimental details are often omitted due to size or time constraints, or simply because the complexity in terms of technical setup or parametrization became intractable. Even access to code bases, disregard important properties of the environment and experimental setup, like for example random generators or computing infrastructure. At the same time, tracking and communicating an often inherently exploratory scientific process is a task with considerable effort. We explored different venues to tackle these issues from a data science engineering point of view. The efforts resulted in PyPads, a framework providing an infrastructure to extend experimental setups with logging, communication and analysis features in a mostly non-intrusive way. PyPads can be extended to different Python-based frameworks, utilizing community driven, descriptive metadata in an effort to harmonize library specific logs in an ontology. Meanwhile, we also try to emphasize similarities to practices in software engineering, which have turned out to be essential in practical applications. KW - Machine Learning KW - Reproducibility KW - Open Science KW - Automated Logging KW - Python Y1 - 2023 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:101:1-2024021511222778687954 VL - 24 IS - 1 SP - 53 EP - 62 PB - Springer Nature CY - Berlin ER - TY - THES A1 - Fellicious, Christofer T1 - Bridging the gap: Applying machine learning techniques in digital forensics N2 - With the increasing adoption of virtualization technologies across various industries, virtual machines (VMs) offer cost-effective solutions for obtaining computing power without the burden of initial investment or ongoing maintenance. However, the widespread use of VMs also increases the risk of malicious actors attempting to gain unauthorized access due to the possibility of accessing the VMs via standard internet protocols. Virtual Machine Introspection (VMI) and Forensic Memory Analysis (FMA) are two key cybersecurity methods for addressing these threats. While FMA leverages digital forensic techniques to extract and analyse information from system memory to explain security incidents, VMI typically works with live systems, analysing running processes to detect real-time threats. Both approaches face a significant challenge known as the ”semantic gap,” which arises from the need to infer high-level system information from low-level data such as physical memory and CPU registers. This dissertation explores using machine learning to bridge the semantic gap in FMA and VMI applications. The research uses OpenSSH process heap dumps as a use-case to extract high-level structures, such as OpenSSH encryption keys, from raw process memory dumps. The study employs various techniques to isolate relevant memory sections, from basic memory chunking and entropy analysis to more advanced methods utilizing pointers and malloc headers. During this research study, we also identified the need for a foundation model in memory forensics. Foundation models are general purpose models trained on large amounts of data and users can later use these models to perform different tasks by finetuning the model. This research also addresses the challenge of detecting malware by analysing system-level API calls and employing custom feature engineering techniques. Given that the threat landscape is constantly evolving, we also investigate concept drift — a phenomenon where input data distribution changes affect predictive models’ performance. To mitigate the degradation in performance due to concept drift, we introduce a concept drift detection algorithm complemented by a custom sampling method that optimizes training data selection. This approach reduces the training dataset size by one-third, enhancing the efficiency of model training while maintaining high performance. KW - semantic gap KW - virtual machine introspection KW - forensic memory analysis Y1 - 2025 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:bvb:739-opus4-18473 ER -