Offline Forensic Correlation of Volatile Memory and Network Traffic for Process-Level Network Activity Attribution
Keywords:
Confidence scoring, Digital forensics, Forensic timeline, Memory forensics, Network forensics, PCAP analysis, Process-to-network correlation, Volatile memoryAbstract
Many digital forensics investigations will need to analyze both volatile memory and captured network traffic to be able to reconstruct process-based network behavior. Unfortunately, such evidence is analyzed separately, and thus, it becomes challenging to tie any particular network communication to the process behind it. This study introduces NAAS (Network Activity Attribution System), an offline forensics tool that correlates volatile memory artifacts and PCAPs for process-based network activity attribution. Volatility 3 and TShark are utilized in NAAS to analyze process and network connection artifacts in memory dumps and network flow information from PCAPs, respectively. The extracted evidence is normalized into a shared representation and matched based on endpoint addresses, ports, transport protocols, and timestamps. The approach generates process-network correlations, a confidence score for the correlation, a timeline of the consolidated forensics, and a list of network events that are not sufficiently supported by the provided memory evidence. Four controlled scenarios were used in the initial study with F1-scores from 87.7% to 94.5%. Nevertheless, the lack of sample sizes, confusion matrices, metadata about the datasets, and repeatable experimental runs makes replication of these results impossible. For this reason, the new evaluation methodology defines the required characteristics of the datasets, the approach to generating ground-truth data, the correlation rules, and computational measurements needed for validation of the approach. The framework is expected to be useful for reconstructing an incident offline and triaging evidence. In particular, its output should be understood as evidence-backed process-network associations and not proof of process causality.
References
K. Kent, S. Chevalier, T. Grance, and H. Dang, Guide to Integrating Forensic Techniques into Incident Response, NIST Special Publication 800-86, Gaithersburg, MD, USA, Aug. 2006.
A. Case and G. G. Richard III, “Memory forensics: The path forward,” Digital Investigation, vol. 20, pp. 23–33, Mar. 2017.
M. H. Ligh, A. Case, J. Levy, and A. Walters, The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory. Indianapolis, IN, USA: Wiley, 2014.
Volatility Foundation, “Volatility 3: The volatile memory extraction framework.”
S. Khan, A. Gani, A. W. A. Wahab, M. Shiraz, and I. Ahmad, “Network forensics: Review, taxonomy, and open challenges,” Journal of Network and Computer Applications, vol. 66, pp. 214–235, May 2016.
L. F. Sikos, “Packet analysis for network forensics: A comprehensive survey,” Forensic Science International: Digital Investigation, vol. 32, Mar. 2020.
R. Hunt and S. Zeadally, “Network forensics: An analysis of techniques, tools, and trends,” Computer, vol. 45, no. 12, pp. 36–43, Dec. 2012.
N. Meghanathan, S. R. Allam, and L. A. Moore, “Tools and techniques for network forensics,” International Journal of Network Security & Its Applications, vol. 1, no. 1, Apr. 2009.
F. Casino et al., “Research trends, challenges, and emerging topics in digital forensics: A review of reviews,” in IEEE Access, vol. 10, pp. 25464–25493, 2022.
X. Fu, X. Du, B. Luo, J. Shi, Z. Guan and Y. Wang, “Correlating processes for automatic memory evidence analysis,” 2015 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Hong Kong, China, 2015, pp. 115–120.
I. Shakhsheer, M. Abdallah, I. Mashaqi and A. Awad, “Automated forensic analysis following memory content using volatility framework,” 2023 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies (3ICT), Sakheer, Bahrain, 2023, pp. 369–374.
Z. Khalid, F. Iqbal, K. Al-Hussaeni, A. MacDermott, and M. Hussain, “Forensic analysis of Microsoft Teams: Investigating memory, disk and network,” Science and Technologies for Smart Cities, 2022, pp. 583–601.
A. Alshaya, A. Kardorff, C. Facundus, I. Baggili, and G. G. Richard III, “Memory forensics of the OpenDaylight software-defined networking (SDN) controller,” Proceedings of the 18th International Conference on Availability, Reliability and Security, Aug. 2023, pp. 1–8.
D. Baier, A. Basse, J.-N. Hilgert, and M. Lambertz, “TLS key material identification and extraction in memory: Current state and future challenges,” Forensic Science International: Digital Investigation, vol. 49, Jul. 2024.
F. Y. Loumachi, M. C. Ghanem, and M. A. Ferrag, “Advancing cyber incident timeline analysis through retrieval-augmented generation and large language models,” Computers, vol. 14, no. 2, Feb. 2025.
G. Combs et al., “Wireshark: Network protocol analyzer.” Wireshark Foundation.
