Demonstration venue · read-only. Every page can be browsed; the buttons that would change it are switched off. Create an account to run TaxoReview on your own data. A simulation from public publication records: the people listed were not invited and did not agree to review.
? Tutorial for this page

Rachel Petrik

dblp:248/7269 · also Rachel L. Petrik · DBLP profile ↗
← Back
1ranked-venue papers
1as first author
0since 2021 · last 2018
—ORCID · none

Domains — the database's venue-derived domains; a paper can count in several

Security and privacy · 1 · 1 first-author

Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.

Network and information security
1 paper
Digital forensics and information hiding · 77% Malware analysis · 23%

Topics — the 2 heaviest of 2, each with the papers that count most for it

TopicWeightPapersLastEvidence papers
Digital forensics and information hiding › digital forensics
memory forensics
0.312018
Towards Architecture and OS-Independent Malware Detection via Memory Forensics · CCS 2018
Malware analysis › rootkit detection
compromise detection
0.112018
Towards Architecture and OS-Independent Malware Detection via Memory Forensics · CCS 2018

Methods — techniques the papers use, named apart from their topics

machine learning · 0.3deep learning · 0.3
YearPublicationVenuePosition
2018 Towards Architecture and OS-Independent Malware Detection via Memory Forensics
abstract
In this work, we take a fundamentally different approach to the problem of analyzing a device for compromises via malware; our approach is OS and instruction architecture independent and relies only on having the raw binary data extracted from the memory dump of a device. Our system leverages a multi-hundred TB dataset of both compromised host memory dumps extracted from the MalRec dataset [8] and the first known dataset of benign host memory dumps running normal, non-compromised software. After an average of 30 to 45 seconds of pre-processing on a single memory dump, our system leverages both traditional machine learning and deep learning algorithms to achieve an average of 98% accuracy of detecting a compromised host.
Rachel Petrik, Berat Arik, Jared M. Smith
CCS1