Seifert, Christian, Steenson, Ramon, Welch, Ian and Komisarczuk, Peter (2007) Capture - a behavioral analysis tool for applications and documents. In: The Digital Forensic Research Conference, 13-15 Aug 2007, Pittsburgh, USA.

Full text not available from this repository.

Abstract

In this paper, we present Capture, a tool for behavioral analysis of applications for the Win32 operating system family. Capture is able to monitor the state of a system during the execution of applications and processing of documents, which provides the analyst with insights on how the software operates even if no source code is available. Capture differs from existing behavioral analysis tools in its ability to monitor state changes on a low kernel level and its ability to be easily used across operating systems, various versions and configurations. Capture provides a powerful mechanism to exclude event noise that naturally occurs on an idle system or when using a specific application. This mechanism is fine-grained and allows an analyst to take into account the process that causes the various state changes. As a result, this mechanism even allows Capture to analyze the behavior of documents that execute within the context of an application. We demonstrate Capture's capabilities by analyzing a malicious Microsoft Word document.

Item Type:	Conference or Workshop Item (Paper)
ISSN:	1742-2876
Identifier:	10.1016/j.diin.2007.06.003
Page Range:	S23-S30
Identifier:	10.1016/j.diin.2007.06.003
Keywords:	Security; Forensics; Behavioral analysis; Application analysis; Document analysis
Subjects:	Computing
Depositing User:	Vani Aul
Date Deposited:	21 Mar 2014 14:34
Last Modified:	28 Aug 2021 07:17
URI:	https://repository.uwl.ac.uk/id/eprint/807

Actions (login required)

View Item