{"id":"https://openalex.org/W7170233747","doi":"https://doi.org/10.25772/qagm-sc94","title":"Advancing Cybersecurity Through Userland Memory Forensics: From Runtime Analysis to Security Applications","display_name":"Advancing Cybersecurity Through Userland Memory Forensics: From Runtime Analysis to Security Applications","publication_year":2026,"publication_date":"2026-08-21","ids":{"openalex":"https://openalex.org/W7170233747","doi":"https://doi.org/10.25772/qagm-sc94"},"language":"en","primary_location":{"id":"pmh:oai:scholarscompass.vcu.edu:etd-9651","doi":null,"is_oa":false,"landing_page_url":"https://scholarscompass.vcu.edu/etd/8454","pdf_url":null,"source":{"id":"https://openalex.org/S4377196340","display_name":"VCU Scholars Compass (Virginia Commonwealth University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I184840846","host_organization_name":"Virginia Commonwealth University","host_organization_lineage":["https://openalex.org/I184840846"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Theses and Dissertations","raw_type":"text"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.25772/qagm-sc94","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136236259","display_name":"Hala Ali","orcid":"https://orcid.org/0000-0002-2346-3572","observed_orcids":["https://orcid.org/0000-0002-2346-3572"]},"institutions":[{"id":"https://openalex.org/I184840846","display_name":"Virginia Commonwealth University","ror":"https://ror.org/02nkdxk79","country_code":"US","type":"education","lineage":["https://openalex.org/I184840846"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Ali, Hala","raw_affiliation_strings":["Computer Science, Virginia Commonwealth University"],"raw_orcid":"https://orcid.org/0000-0002-2346-3572","affiliations":[{"raw_affiliation_string":"Computer Science, Virginia Commonwealth University","institution_ids":["https://openalex.org/I184840846"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5136236259"],"corresponding_institution_ids":["https://openalex.org/I184840846"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.50423979,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.0010000000474974513,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware-detection","display_name":"malware detection","score":0.6710000038146973},{"id":"https://openalex.org/keywords/supply-chain-security","display_name":"supply chain security","score":0.7039999961853027},{"id":"https://openalex.org/keywords/software-bill-of-materials","display_name":"software bill of materials","score":0.9580000042915344},{"id":"https://openalex.org/keywords/memory-forensics","display_name":"memory forensics","score":0.550000011920929},{"id":"https://openalex.org/keywords/encryption-key-recovery","display_name":"encryption key recovery","score":0.8619999885559082}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8407999873161316},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6227999925613403},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.5792999863624573},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5551999807357788},{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.5052000284194946},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.46860000491142273},{"id":"https://openalex.org/C28180684","wikidata":"https://www.wikidata.org/wiki/Q4080983","display_name":"Memory safety","level":3,"score":0.43309998512268066},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.420199990272522},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.40049999952316284},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.39750000834465027},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.37529999017715454},{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.3750999867916107},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.3736000061035156},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3601999878883362},{"id":"https://openalex.org/C2777407602","wikidata":"https://www.wikidata.org/wiki/Q1888932","display_name":"Mandatory access control","level":4,"score":0.3467000126838684},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.33889999985694885},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.3197999894618988},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.31859999895095825},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.31200000643730164},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.30790001153945923},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3059000074863434},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.3019999861717224},{"id":"https://openalex.org/C174683762","wikidata":"https://www.wikidata.org/wiki/Q609588","display_name":"Component-based software engineering","level":4,"score":0.296999990940094},{"id":"https://openalex.org/C2781357168","wikidata":"https://www.wikidata.org/wiki/Q5276084","display_name":"Digital evidence","level":3,"score":0.29109999537467957},{"id":"https://openalex.org/C147346212","wikidata":"https://www.wikidata.org/wiki/Q5492632","display_name":"Trusted computing base","level":4,"score":0.2847000062465668},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.28200000524520874},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.27730000019073486},{"id":"https://openalex.org/C34165917","wikidata":"https://www.wikidata.org/wiki/Q188267","display_name":"Programming paradigm","level":2,"score":0.2759000062942505},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.27559998631477356},{"id":"https://openalex.org/C77714075","wikidata":"https://www.wikidata.org/wiki/Q5452017","display_name":"Firewall (physics)","level":5,"score":0.2750999927520752},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2750999927520752},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.27410000562667847},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.26190000772476196},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.26100000739097595},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.2590999901294708},{"id":"https://openalex.org/C29024540","wikidata":"https://www.wikidata.org/wiki/Q1476964","display_name":"Covert channel","level":5,"score":0.25839999318122864},{"id":"https://openalex.org/C205711294","wikidata":"https://www.wikidata.org/wiki/Q176953","display_name":"Rendering (computer graphics)","level":2,"score":0.25699999928474426},{"id":"https://openalex.org/C3073032","wikidata":"https://www.wikidata.org/wiki/Q15912075","display_name":"Information hiding","level":3,"score":0.25679999589920044},{"id":"https://openalex.org/C50747538","wikidata":"https://www.wikidata.org/wiki/Q7001032","display_name":"Network forensics","level":3,"score":0.25519999861717224}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:scholarscompass.vcu.edu:etd-9651","doi":null,"is_oa":false,"landing_page_url":"https://scholarscompass.vcu.edu/etd/8454","pdf_url":null,"source":{"id":"https://openalex.org/S4377196340","display_name":"VCU Scholars Compass (Virginia Commonwealth University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I184840846","host_organization_name":"Virginia Commonwealth University","host_organization_lineage":["https://openalex.org/I184840846"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Theses and Dissertations","raw_type":"text"},{"id":"doi:10.25772/qagm-sc94","doi":"https://doi.org/10.25772/qagm-sc94","is_oa":true,"landing_page_url":"https://doi.org/10.25772/qagm-sc94","pdf_url":null,"source":{"id":"https://openalex.org/S7407053258","display_name":"VCULIBRARIES","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I184840846","host_organization_name":"Virginia Commonwealth University","host_organization_lineage":["https://openalex.org/I184840846"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dissertation"}],"best_oa_location":{"id":"doi:10.25772/qagm-sc94","doi":"https://doi.org/10.25772/qagm-sc94","is_oa":true,"landing_page_url":"https://doi.org/10.25772/qagm-sc94","pdf_url":null,"source":{"id":"https://openalex.org/S7407053258","display_name":"VCULIBRARIES","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I184840846","host_organization_name":"Virginia Commonwealth University","host_organization_lineage":["https://openalex.org/I184840846"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dissertation"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4412819163","https://openalex.org/W4281838744","https://openalex.org/W7170080152","https://openalex.org/W2415908313","https://openalex.org/W4284961255","https://openalex.org/W3180445466","https://openalex.org/W6997323118","https://openalex.org/W7123660869","https://openalex.org/W7165817740","https://openalex.org/W7211112350"],"abstract_inverted_index":{"Memory":[0],"forensics":[1,36,214,236],"has":[2],"become":[3],"a":[4,107,111,139,198],"crucial":[5],"component":[6],"of":[7,114,130,141,169],"digital":[8],"investigations,":[9],"particularly":[10],"for":[11],"detecting":[12],"malware":[13,27,84],"operating":[14,20],"solely":[15],"in":[16,153],"system":[17,21],"memory.":[18,185],"As":[19],"vendors":[22],"implemented":[23],"kernel":[24],"access":[25],"restrictions,":[26],"authors":[28],"shifted":[29],"to":[30,216],"userland":[31,45,234],"malware.":[32],"However,":[33],"existing":[34],"memory":[35,56,213,235],"techniques":[37,77,87,144,164],"have":[38],"largely":[39],"focused":[40],"on":[41],"kernel-level":[42],"analysis,":[43],"leaving":[44],"runtimes":[46],"insufficiently":[47],"covered.":[48],"This":[49],"dissertation":[50,104,137],"addresses":[51],"this":[52],"gap":[53],"by":[54],"expanding":[55],"analysis":[57],"capabilities":[58,132],"across":[59,238,244],"two":[60],"distinct":[61],"paradigms:":[62],"interpreted":[63],"and":[64,96,120,181,223],"compiled":[65],"runtimes.":[66],"The":[67,203],"first":[68,212],"phase":[69,205],"targets":[70,206],"the":[71,103,128,136,162,207,211],"Python":[72,147,150],"runtime,":[73,209],"developing":[74],"automated":[75],"recovery":[76],"that":[78,109,145,233],"enable":[79],"several":[80],"security":[81,245],"applications.":[82],"For":[83,99],"detection,":[85],"these":[86,131,230],"extract":[88],"critical":[89],"forensic":[90,167],"artifacts":[91],"such":[92,156],"as":[93,157,193],"encryption":[94],"keys":[95],"command-and-control":[97],"configurations.":[98],"supply":[100],"chain":[101],"security,":[102],"presents":[105],"MEM-SBOM,":[106],"framework":[108,190,215],"generates":[110],"Software":[112],"Bill":[113],"Materials":[115],"directly":[116],"from":[117,184,226],"runtime":[118,224],"state":[119,225],"performs":[121],"function-level":[122],"vulnerability":[123],"reachability":[124],"analysis.":[125],"To":[126],"assess":[127],"robustness":[129],"under":[133],"adversarial":[134],"conditions,":[135],"develops":[138],"taxonomy":[140],"68":[142],"evasion":[143],"exploit":[146],"internals.":[148],"Since":[149],"is":[151,201],"embedded":[152],"domain-specific":[154],"applications":[155],"Ultimaker":[158],"Cura":[159],"slicing":[160],"software,":[161],"developed":[163],"extend":[165],"into":[166],"investigation":[168],"3D":[170],"printing":[171],"activities":[172],"through":[173],"SliceSnap,":[174],"which":[175],"recovers":[176],"design":[177],"files,":[178],"G-code":[179,192],"instructions,":[180],"printer":[182],"metadata":[183],"A":[186],"complementary":[187],"machine":[188],"learning":[189],"classifies":[191],"benign":[194],"or":[195],"malicious":[196],"when":[197],"reference":[199],"baseline":[200],"unavailable.":[202],"second":[204],"Go":[208],"presenting":[210],"recover":[217],"function":[218],"metadata,":[219],"strings,":[220],"execution":[221],"paths,":[222],"goroutine":[227],"stacks.":[228],"Together,":[229],"frameworks":[231],"demonstrate":[232],"generalizes":[237],"programming":[239],"paradigms":[240],"with":[241],"broad":[242],"applicability":[243],"domains.":[246]},"counts_by_year":[],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-07-24T00:00:00"}