论文标题
SmartKex：机器学习协助SSH键从堆垃圾场提取
SmartKex: Machine Learning Assisted SSH Keys Extraction From The Heap Dump
论文作者
论文摘要
数字取证是在数字设备中提取，保存和记录证据的过程。数字取证中的一种常用方法是从数字设备的主要内存中提取数据。但是，主要的挑战是确定要提取的重要数据。几个关键信息都存在于主内存中，例如用户名，密码和加密密钥，例如SSH会话键。在本文中，我们提出了SmartKex，SmartKex是一种机器学习辅助方法，以从OpenSSH进程的Heap Memory快照中提取会话键。此外，我们发布了一个公开可用的数据集和用于创建其他数据的相应工具链。最后，我们将SmartKex与Naive Brute Force方法进行比较，并从经验上表明SmartKex可以以高精度和高吞吐量提取会话键。有了提供的资源，我们打算加强有关数字取证，网络安全和机器学习之间交集的研究。
Digital forensics is the process of extracting, preserving, and documenting evidence in digital devices. A commonly used method in digital forensics is to extract data from the main memory of a digital device. However, the main challenge is identifying the important data to be extracted. Several pieces of crucial information reside in the main memory, like usernames, passwords, and cryptographic keys such as SSH session keys. In this paper, we propose SmartKex, a machine-learning assisted method to extract session keys from heap memory snapshots of an OpenSSH process. In addition, we release an openly available dataset and the corresponding toolchain for creating additional data. Finally, we compare SmartKex with naive brute-force methods and empirically show that SmartKex can extract the session keys with high accuracy and high throughput. With the provided resources, we intend to strengthen the research on the intersection between digital forensics, cybersecurity, and machine learning.
