Are memory forensic tools useful for attack detection? Usually they are applied after an attack has happened. You could always constantly scan a machine but this requires lots of resources and depending on how often you scan leaves a window for an attacker to go unnoticed and when scanning as fast as possible would probably overwhelm the analysis system.

Ideally they would work on a higher privilege level like hypervisor or physical layer. With modern devices you often have soldered RAM, there are mitigations for DMA attacks, they lack any way of plugging something useful in. On the hypervisor level the question is how well the system you intend to analyse can be emulated or if it can have the same security level as run on bare metal.

  • 1
    Forensic tools aren't made for detection, they're made for analysis.
    – user163495
    Jun 24, 2021 at 12:17
  • There is some research into this, but no practical products have been released.
    – forest
    Jun 25, 2021 at 0:25


You must log in to answer this question.

Browse other questions tagged .