Author ORCID Identifier
https://orcid.org/0000-0002-2346-3572
Defense Date
2026
Document Type
Dissertation
Degree Name
Doctor of Philosophy
Department
Computer Science
First Advisor
Irfan Ahmed
Abstract
Memory forensics has become a crucial component of digital investigations, particularly for detecting malware operating solely in system memory. As operating system vendors implemented kernel access restrictions, malware authors shifted to userland malware. However, existing memory forensics techniques have largely focused on kernel-level analysis, leaving userland runtimes insufficiently covered. This dissertation addresses this gap by expanding memory analysis capabilities across two distinct paradigms: interpreted and compiled runtimes. The first phase targets the Python runtime, developing automated recovery techniques that enable several security applications. For malware detection, these techniques extract critical forensic artifacts such as encryption keys and command-and-control configurations. For supply chain security, the dissertation presents MEM-SBOM, a framework that generates a Software Bill of Materials directly from runtime state and performs function-level vulnerability reachability analysis. To assess the robustness of these capabilities under adversarial conditions, the dissertation develops a taxonomy of 68 evasion techniques that exploit Python internals. Since Python is embedded in domain-specific applications such as Ultimaker Cura slicing software, the developed techniques extend into forensic investigation of 3D printing activities through SliceSnap, which recovers design files, G-code instructions, and printer metadata from memory. A complementary machine learning framework classifies G-code as benign or malicious when a reference baseline is unavailable. The second phase targets the Go runtime, presenting the first memory forensics framework to recover function metadata, strings, execution paths, and runtime state from goroutine stacks. Together, these frameworks demonstrate that userland memory forensics generalizes across programming paradigms with broad applicability across security domains.
Rights
© Hala Ali
Is Part Of
VCU University Archives
Is Part Of
VCU Theses and Dissertations
Date of Submission
7-21-2026