Automated forensic extraction of encryption keys using behavioural analysis

Gareth Owen

Automated forensic extraction of encryption keys using behavioural analysis

Gareth Owen

Research output: Contribution to conference › Paper › peer-review

199 Downloads (Pure)

Abstract

In this paper we describe a technique for automatic algorithm identification and information extraction from unknown binaries. We emulate the binary using PyEmu forcing complete code coverage whilst simultaneously examining its behavior. Our behavior matcher then identifies specific algorithmic behavior and extracts information. We demonstrate the use of this technique for automated extraction of encryption keys from an unseen program with no prior knowledge about its implementation. Our technique can also be used for automatic categorization and suggestion of function purpose to analysts

Original language	English
Publication status	Published - Jun 2012
Event	IEEE International Conference on Cyber Security, Cyber Warfare and Digital Forensics - Kuala Lumpur, Malaysia Duration: 26 Jun 2012 → 28 Jun 2012

Conference

Conference	IEEE International Conference on Cyber Security, Cyber Warfare and Digital Forensics
Country/Territory	Malaysia
City	Kuala Lumpur
Period	26/06/12 → 28/06/12

Access to Document

Owen_Camera_IEEECertified.pdfFinal published version, 96.2 KB

Cite this

@conference{a614b3aa58c542fb973dcea9c03b1a93,

title = "Automated forensic extraction of encryption keys using behavioural analysis",

abstract = "In this paper we describe a technique for automatic algorithm identification and information extraction from unknown binaries. We emulate the binary using PyEmu forcing complete code coverage whilst simultaneously examining its behavior. Our behavior matcher then identifies specific algorithmic behavior and extracts information. We demonstrate the use of this technique for automated extraction of encryption keys from an unseen program with no prior knowledge about its implementation. Our technique can also be used for automatic categorization and suggestion of function purpose to analysts",

author = "Gareth Owen",

year = "2012",

month = jun,

language = "English",

note = "IEEE International Conference on Cyber Security, Cyber Warfare and Digital Forensics ; Conference date: 26-06-2012 Through 28-06-2012",

}

TY - CONF

T1 - Automated forensic extraction of encryption keys using behavioural analysis

AU - Owen, Gareth

PY - 2012/6

Y1 - 2012/6

N2 - In this paper we describe a technique for automatic algorithm identification and information extraction from unknown binaries. We emulate the binary using PyEmu forcing complete code coverage whilst simultaneously examining its behavior. Our behavior matcher then identifies specific algorithmic behavior and extracts information. We demonstrate the use of this technique for automated extraction of encryption keys from an unseen program with no prior knowledge about its implementation. Our technique can also be used for automatic categorization and suggestion of function purpose to analysts

AB - In this paper we describe a technique for automatic algorithm identification and information extraction from unknown binaries. We emulate the binary using PyEmu forcing complete code coverage whilst simultaneously examining its behavior. Our behavior matcher then identifies specific algorithmic behavior and extracts information. We demonstrate the use of this technique for automated extraction of encryption keys from an unseen program with no prior knowledge about its implementation. Our technique can also be used for automatic categorization and suggestion of function purpose to analysts

M3 - Paper

T2 - IEEE International Conference on Cyber Security, Cyber Warfare and Digital Forensics

Y2 - 26 June 2012 through 28 June 2012

ER -

Automated forensic extraction of encryption keys using behavioural analysis

Abstract

Conference

Access to Document

Fingerprint

Cite this