2026-09-20T03:50:08Z https://opus4.kobv.de/opus4-uni-passau/oai

oai:kobv.de-opus4-uni-passau:1847 2025-10-22 bibliography:false doc-type:PhDThesis open_access ddc ddc:004

Bridging the gap: Applying machine learning techniques in digital forensics 0000-0001-7487-7110 Christofer Fellicious 004 semantic gap virtual machine introspection forensic memory analysis With the increasing adoption of virtualization technologies across various industries, virtual machines (VMs) offer cost-effective solutions for obtaining computing power without the burden of initial investment or ongoing maintenance. However, the widespread use of VMs also increases the risk of malicious actors attempting to gain unauthorized access due to the possibility of accessing the VMs via standard internet protocols. Virtual Machine Introspection (VMI) and Forensic Memory Analysis (FMA) are two key cybersecurity methods for addressing these threats. While FMA leverages digital forensic techniques to extract and analyse information from system memory to explain security incidents, VMI typically works with live systems, analysing running processes to detect real-time threats. Both approaches face a significant challenge known as the ”semantic gap,” which arises from the need to infer high-level system information from low-level data such as physical memory and CPU registers. This dissertation explores using machine learning to bridge the semantic gap in FMA and VMI applications. The research uses OpenSSH process heap dumps as a use-case to extract high-level structures, such as OpenSSH encryption keys, from raw process memory dumps. The study employs various techniques to isolate relevant memory sections, from basic memory chunking and entropy analysis to more advanced methods utilizing pointers and malloc headers. During this research study, we also identified the need for a foundation model in memory forensics. Foundation models are general purpose models trained on large amounts of data and users can later use these models to perform different tasks by finetuning the model. This research also addresses the challenge of detecting malware by analysing system-level API calls and employing custom feature engineering techniques. Given that the threat landscape is constantly evolving, we also investigate concept drift — a phenomenon where input data distribution changes affect predictive models’ performance. To mitigate the degradation in performance due to concept drift, we introduce a concept drift detection algorithm complemented by a custom sampling method that optimizes training data selection. This approach reduces the training dataset size by one-third, enhancing the efficiency of model training while maintaining high performance. Universität Passau Passau Innstrasse 29, 94032 Passau 0000-0003-3566-5507 Michael Granitzer 0000-0003-1737-6218 Stelvio Cimato 2025-07-23 2025-10-22 PhDThesis Text urn:nbn:de:bvb:739-opus4-18473 application/pdf eng Creative Commons - CC BY - Namensnennung 4.0 International thesis.doctoral Universität Passau Passau Fakultät für Informatik und Mathematik 1 https://opus4.kobv.de/opus4-uni-passau/oai/container/index/docId/1847 https://opus4.kobv.de/opus4-uni-passau/frontdoor/index/index/docId/1847