Search

In email systems, one of the most widely used attacks is email spoofing, in which the source address of the email message is forged to make the recipient of the email believe that the email was sent from a legitimate source. Several research works have been presented in the past to address email spoofing attack. Further, in recent years, the technique of memory forensics has evolved significantly where critical evidence is extracted from the volatile memory of the target machine during a cyber crime investigation. In this paper, we utilize memory forensics to detect if the client received any spoofed email. In addition, our memory forensics approach detects if the client replied to any spoofed emails. The memory of the client machine is acquired on a scheduled basis and the acquired memory dump is analyzed to identify spoofing attack and, if detected, storing the details in log files that can be used by cyber crime investigators. The benefit of applying memory forensics to detect spoofed emails is that it guarantees non-repudiation since every action performed on a computer is loaded in the system's physical memory, including email communication, and hence the user cannot deny receiving or replying to spoofed email.

Processors in sensor nodes offer very deep sleep modes to save energy and to increase the battery lifetime with the disadvantage that the content of the volatile memory will be typically lost in these modes. The backup and restore of data from volatile to non-volatile memories is expensive regarding the energy budget. Emerging new memory technologies offer the opportunity for new memory layouts in such embedded processors, and possibly help to reduce the energy consumption in low-duty cycle application. In this work an energy estimation approach for low-duty-cycle applications is presented, which estimates the energy cost, based on memory operations only. With that approach various memory layouts based on new non-volatile memory architectures are compared against each other. It turns out that the use of the new NV memories is a massive gain for the lifetime of sensor nodes.

Near-data in-memory processing research has been gaining momentum in recent years. Typical processing-in-memory architecture places a single or several processing elements next to a volatile memory, enabling processing without transferring data to the host CPU. The increased bandwidth to and from volatile memory leads to performance gain. However processing-in-memory does not alleviate von Neumann bottleneck for big data problems, where datasets are too large to fit in main memory. We present a novel processing-in-storage system based on Resistive Content Addressable Memory ReCAM. It functions simultaneously as a mass storage and as a massively parallel associative processor. ReCAM processing-in-storage resolves the bandwidth wall by keeping computation inside the storage arrays, without transferring it up the memory hierarchy. We show that ReCAM based processing-in-storage architecture may outperform existing processing-in-memory and accelerator based designs. ReCAM processing-in-storage implementation of Smith-Waterman DNA sequence alignment reaches a speedup of almost five over a GPU cluster. An implementation of in-storage inline data deduplication is presented and shown to achieve orders of magnitude higher throughput than traditional CPU and DRAM based systems.

Crimes are rapidly increasing, and criminals today use digital devices to facilitate criminal activities. The majority of individuals now own at least a Personal Computer (PC). This has in turn led to Social Media being used as a key medium for information gathering and exchange. Criminals tend to search through social media platforms and extract data which will facilitate them. Additionally, social media platforms such as Facebook, Viber, Skype are used to exchange information about criminal activities. Such information relating to social media can be highly critical evidence at a forensic investigation. A variety of different tools have been necessary for forensics investigators to extract evidence from computers. The main focus on capturing traces left behind after crimes has been the data stored in hard drives. Yet, a significant amount of data is stored in volatile memory as well, and these traces might be very important evidence in solving a case. But the volatile memory is mostly not looked at. All such information exchanged through such applications has to pass through the volatile memory of the system at some point. Even though many applications tend to provide end-to-end encryption, research on volatile memory forensics shows that applications yet write unencrypted data to the RAM (Random Access Memory). This has led to a new area of research towards patterns in how data are written in the volatile memory. This will be a next step in digital forensics, which would assist in recovering evidence that would otherwise get completely lost.

A fast, 128-b implementation of both SRAM and LPROM with integrated periphery in a thin-film amorphous indium–gallium–zinc oxide technology is reported. The SRAM block can be read in 265 $\mu \text{s}$ /byte and written in 110 $\mu \text{s}$ /byte, consumes 12.3 mW, and has an area of 11.9 mm2. Furthermore, after power down, an SRAM memory state retention time of 83 s is shown. The LPROM can be read in 40 $\mu \text{s}$ /b, consumes 4.50 mW, and has an area of 3.75 mm2. The SRAM enables fast volatile RAM memory for thin-film microprocessors, while the LPROM can be used to store the identification code for state-of-the-art thin-film RFID tags.

For many big data applications, non-volatile memory (NVM) can be utilized to store and process the data at faster rate due to its high-performance, scalable technology, DRAM-like interface and low energy requirement. NVMs such as phase change memory and memristor allow the applications to store persistent data directly in memory, and avoid data serialization and deserialization. However, NVM, like volatile memory, is susceptible to data corruption from software bugs. In this work, we present a paradigm shift from current process-based page-protection to a thread-based solution specifically designed for NVM. We have developed SafeNVM, a reliable NVM store to support application-specific data formats. SafeNVM will enable the NVM to provide strong data protection while delivering high performance access. We propose a simple hardware change in TLB and page table entry and exploit bound checking inherent to swizzled pointers. We show that SafeNVM is reliable against a collection of stray writes and the cost to achieve such protection is small.

With the introduction of the Internet of Things (IoT), power consumption became a major design issue in modern system-on-chips. In advanced technologies, leakage power has become a dominant component, especially during sleep periods. Leakage mainly comes from volatile memory elements, e.g., flip-flops that cannot be power-gated in order to retain their states. Non-Volatile Flip-Flop (NVFF) using emerging memory technologies, such as Resistive Random Access Memories (RRAM), are popular solutions to address this issue. In NVFF design, the resistance values of the memory element have a direct impact on the area and energy overhead of the structure. In this paper, we present a design methodology for area and energy efficient RRAM-based NVFF. By characterizing the optimal lower bound of the RRAM resistance ratio required for properly restoring the FF, the store and restore operations can be performed using optimal programming circuit area and energy. Four Transmission-Gate (TG) NVFF topologies implemented in 180nm CMOS technology were analyzed using the proposed methodology. The presented methodology shows that differential NVFF provides minimum restore resistance ratio down to 1.02 considering CMOS and RRAM variability. This enables improvements in terms of store energy (34%) and area overhead (40%) compared to reported state-of-the-art NV-TGFFs design approaches.

In this paper, we consider the verification of the hypothesis in the research of computer incidents study, based on the analysis of attributes and their values with post-incident computer equipment. The essence of the hypothesis constitutes the ability to study computer incidents in the types of computer memory; analyzing only the attributes and their values, without taking into account the contents of the data. The paper describes the process of forming the attributes and their values post-incident computer equipment and also, describing how to create a database of existing computer incidents. In performing these computational experiments, consists of assessing the possibilities of investigating computer incidents on the basis of the analysis of attributes and their values in the created database. Forming an opinion regarding the more informative details about the computer incidents by analysis of attributes and their values from the volatile memory, NVRAM (Non Volatile Random Access Memory), network traffic complex.

The Windows Volatile memory maintains information about the various activities on the system such as processes and its threads running, registry key open, user authentication details. This paper details out the technique to identify and extract the last access time of a registry key based on the key control block of the key objects in use by the running process. The paper also details out the technique to locate and extract the value of a registry key in use by the running process. A framework to reconstruct the user activities based on the registry key accessed by the running process is proposed. The methods discussed in this paper have been verified on the 32-bit Windows 7 and Windows 8 volatile memory dump.

Static Random Access Memory (SRAM) is a volatile memory designed for high speed and low power applications. As the technology is shrinking down, low-voltage operation has become a major design issue for the analog and digital signal processing applications. Floating gate MOSFET has been used here as low power circuit element. The major advantage of using FGMOS is low power dissipation, tunability, compatibility, flexibility and controllability. This paper gives basic implementation of FGMOS in SRAM 6T and 8T cells in 45nm technology using 45 gpdk (Generic Process Design Kit). Various power centric comparisons between 6T, 8T SRAM cells with MOS and FGMOS at 90 nm and 45nm node has been done using Cadence Virtuoso and Spectre simulator.

Research on endpoint security involves both traditional PC platform and prevalent mobile platform, among which the analysis of software vulnerability and malware is one of the important contents. For researchers, it is necessary to carry out nonstop exploration of the insecure factors in order to better protect the endpoints. Driven by this motivation, we propose a new threat model named Process Memory Captor (PMCAP) on the Windows operating system which threatens the live process volatile memory data. Compared with other threats, PMCAP aims at dynamic data in the process memory and uses a noninvasive approach for data extraction. In this paper we describe and analyze the model and then give a detailed implementation taking four popular web browsers IE, Edge, Chrome, and Firefox as examples. Finally, the model is verified through real experiments and case studies. Compared with existing technologies, PMCAP can extract valuable data at a lower cost; some techniques in the model are also suitable for memory forensics and malware analysis.

Malware targeting mobile devices is an ever increasing threat. The most insidious type of malware resides entirely in volatile memory and does not leave a trail of persistent artifacts. Such malware requires novel detection and capture methods in order to be reliably identified, analyzed and mitigated. This chapter proposes malware categorization and detection techniques based on measurable system side-effects observed in an exploited mobile device. Using the Stagefright family of exploits as a case study, common system side-effects produced as a result of attempted exploitation are identified. These system side-effects are leveraged to trigger volatile memory (i.e., RAM) collection by memory acquisition tools (e.g., LiME) to enable analysis of the malware.

This chapter addresses the challenges involved in designing energy efficient embedded volatile Static Random Access Memory (SRAM) circuits for IoT era. It discusses memory design for wide voltage range operation using 6 Transistor (6T), 8T and 10T bitcells and novel circuit assist techniques. In addition, it discusses future memory designs using emerging nano-wire FET, Tunnel FET, III-V FET, and monolithic 3-D technologies.

Rapid growth in technology is increasing day by day that demands computer systems to work better, should be reliable and have faster performance with fair cost and best functionalities. In the modern era of technology, memory files are used to shorten the performance gap between memory and storage. Sustainable in-memory file system (SIMFS) was the first that introduces the concept of open file address space into the address space of the process and exploits the memory mapping hardware while accessing files. The purpose of designing and implementing the SIMFS architecture is to achieve performance improvement of in-memory file system. SCMFS are designed for the storage class system that uses the presented memory management component in the operating system to assist in managing block, and it manages the space for each and every file adjacent to the virtual address space. A recent study has proposed that non-volatile memories are powerful enough to minimize the performance gap, as compared to previous generation non-volatile memories. This is because the performance gap between non-volatile and volatile memories has been reduced and there are possibilities of using a non-volatile memory as a computer’s main memory in near future. Lately, high-speed non-volatile storage media, such as Phase Change Memory (PCM) has come into view and it is expected that for storage device PCM will be used by replacing the hard disk in upcoming years. Moreover, the PCM is byte-addressable, it means that it can access individual byte of data rather than word and data access time is expected to be almost indistinguishable of DRAM, a volatile memory. These features and innovations in computer architecture are making the computer system more reliable and faster.

Many security challenges have emerged from what is defined as Internet of Things (IoT), due to the inherent permanent connection of devices involved in networks. Furthermore, IoT devices are often deployed in unattended working environment and, hence, they are prone to physical attacks. Attackers take advantages of such weaknesses to clone devices, tamper the software installed on them and extract cryptographic keys. In this paper, we propose a technique to exploit Static Random Access Memory based Phisical Unclonable Functions to have available a chain-oftrust on a microcontroller device. We prove its effectiveness in terms of reliability and required overhead by introducing a case study based on the STM32F7 device running the Linux operating system.

After decades of a cache, DRAM, and disk data storage hierarchy, new memory technologies are promising nonvolatility, high endurance, and fine-grained data access--all of which could, with some preparation, enable a new storage paradigm in server systems.

The rise of alternative nonvolatile solid- state storage technology will change the architecture and uses of future consumer devices. Figure 1 shows a typical hierarchical view of memory and storage technologies. The commonly used memory technologies such as static random access memory (SRAM) and dynamic random access memory (DRAM) are volatile memory technologies, and they only retain data when power is applied.

The era of cloud computing on-a-chip is enabled by the aggressive move towards many-core platforms and the rapid adoption of Network-on-Chips. As a result, there is a need for large-scale distributed on-chip shared memories that are reliable, low power, and seamlessly manageable. In this work, we propose SPMCloud , a novel scratchpad-memory-based cloud-inspired volatile storage subsystem designed to meet the needs of future-generation many-core platforms. SPMCloud is composed of several concepts, including: (1) a highly scalable data-center-like memory subsystem that exploits two enterprise-network-inspired memory configurations, namely, embedded Network Attached Storage ( eNAS ) and embedded Storage Area Network ( eSAN ), and (2) on-demand allocation of reliable memory space through memory virtualization and the use of embedded RAIDs. Our experimental results on Mediabench/CHStone benchmarks show that the SPMCloud 's fully distributed reliable memory subsystems can achieve 48% energy savings and 70% latency reduction on average over state-of-the-art NoC memory reliability techniques. We then evaluate the scalability of the SPMCloud and compare it with traditional SPM allocation policies. The SPMCloud 's dynamic allocator outperforms the best competition by an average 60% ( eNAS ) and 46% ( eSAN ) when the platform runs at 250 MHz and by an average 80% ( eNAS ) and 40% when running at 1 GHz. Moreover, the SPMCloud achieves an average 83% energy savings across all configurations (number of cores) with respect to the best competitors when running at 250 MHz and 1 GHz. We then studied the SPM hit ratio across the various allocation policies discussed in this article and showed that on average the SPMCloud 's priority-driven dynamic allocation policy achieves 93.5% SPM hit ratio, 0.6% higher hit ratio than the closest allocation policy. We then showed that the eNAS and eSAN achieve an average of 67.9% and 29% reduction in execution time, respectively, over the best competitor. Similarly, the eNAS and eSAN achieve an average of 82.7% and 82.3% energy savings, respectively, over the best competitor. Furthermore, we evaluated the scalability of the SPMCloud and its performance/energy efficiency when providing support for some of the heavier E-RAID levels, and showed that the eNAS / eSAN configurations with SECDED achieve an average of 51.5% and 34.9% reduction in execution time, respectively, over the best competitor with SECDED. Similarly, the eNAS / eSAN configurations with E-RAID Level 1, + SECDED achieve an average of 82.3% and 75.6% energy savings, respectively, over the best competitor.

An IEEE 802.11 wireless device can leave traces of its presence in the volatile memories of nearby wireless devices. While the devices need to be in radio range of each other for this to happen, they do not need to be connected to the same network—or to any network at all. Traces appear in the form of full wire-type frames; a residue of the signals in the ether. We examine types of information that can be extracted from such residual frames and explore the conditions under which traces develop and persist. Their availability is determined by factors in both in the external environment (the types of signals in the ether) and the internal environment (the configuration and particulars of a device's wifi stack). To isolate some of these factors, we have created memory dumps of devices in various environments and configurations. Analysis of the dumps has offered insights into the conditions determining creation and decay of the traces. The results indicate that they will be available in a limited number of real-world scenarios. We conclude with practical advice on triaging and preservation.

Storing digital information, ensuring the accuracy, steady and uninterrupted access to the data are considered as fundamental challenges in enterprise-class organizations and companies. In recent years, new types of storage systems such as solid state disks (SSD) have been introduced. Unlike hard disks that have mechanical structure, SSDs are based on flash memory and thus have electronic structure. Generally a SSD consists of a number of flash memory chips, some buffers of the volatile memory type, and an embedded microprocessor, which have been interconnected by a port. This microprocessor run a small file system which called flash translation layer (FTL). This software controls and schedules buffers, data transfers and all flash memory tasks. SSDs have some advantages over hard disks such as high speed, low energy consumption, lower heat and noise, resistance against damage, and smaller size. Besides, some disadvantages such as limited endurance and high price are still challenging. In this study, the effort is to combine two common technologies - SLC and MLC chips - used in the manufacture of SSDs in a single SSD to decrease the side effects of current SSDs. The idea of using multi-layer SSD is regarded as an efficient solution in this field., Comment: 13 pages, 18 figures

Computer memory systems traditionally use distinct technologies for different hierarchy levels, typically volatile, high speed, high cost/byte solid state memory for caches and main memory (SRAM and DRAM), and non-volatile, low speed, low cost/byte technologies (magnetic disks and flash) for secondary storage. Currently, non-volatile memory (NVM) technologies are emerging and may substantially change the landscape of memory systems. In this work we assess system-level latency and energy impacts of a computer with persistent main memory using PCRAM and Memristor, comparing the development and execution of a search engine application implementing both a traditional file-based approach and a memory persistence approach (Mnemosyne). Our observations show that using memory persistence on top of NVM main memory, instead of a file-based approach on top DRAM/Disk, produces less than half lines of code, is more than 4x faster to develop, consumes 33x less memory energy, and executes search tasks up to 33x faster.

Phase-change memory (PCM) is the best candidate for the storage device of next-generation mobile consumer electronics. PCM has the potential to replace NAND flash memory, due to its non-volatility, in-place programmability, and low power consumption. Even though the lifetime of PCM is longer than that of flash memory, wear leveling is still required to cope with the non-uniformity of storage workload or malicious attack. In this paper, a novel wear-leveling algorithm for PCM storage is proposed, where more physical pages are allocated to frequently updated logical pages, to balance the wear counts of PCM cells. In comparison with the previous techniques, the proposed algorithm improved the lifetime of PCM by at maximum 14 times and on average 8 times.

Surface-confined molecular logic gates have great potential as memory devices. We present in this article the uses of electropolymerized films as a molecular platform for volatile memory devices. A vinyl-substituted cyclometalated ruthenium–amine hybridized compound has been polymerized by reductive electropolymerization. The resulting polymeric films display two well-defined redox processes at +0.32 and +0.68 V vs. Ag/AgCl, leading to three well-separated redox states. Characterizations of these films by XPS and TEM techniques are presented. The singly- and doubly-oxidized states of the film possess intense absorption at 1070 and 700 nm, respectively. These polymeric films exhibit promising three-stage near-infrared electrochromism and the best contrast ratios (ΔT%) of 52% at 1070 nm and 76% at 700 nm have been achieved. The colors of the film at three redox stages are purple, brown, and sky blue, respectively. The electrochromism is featured by a long retention time at all three stages (infinity at −0.20 V, 4 h at +0.55 V, and 30 min at +1.05 V, respectively). The singly- and doubly-oxidized states of a film about 10 nm thick have been used to build a surface-confined Set/Reset flip-flop memory with two electrochemical inputs and two near-infrared optical outputs. By using another intermediate state between the singly- and doubly-oxidized states a multi-valued logic system has been demonstrated.

Objectives: To evaluate the performance of different tools that acquire, analyze and recover the evidences of crime from volatile memory. A comparison between different tools is presented with the aim of generating better understanding of the tools employed. Methods: Volatile memory stays for a very short period and that is why it is always hard to analyze such memory. It contains much useful information such as passwords, usernames, running processes, etc. Acquiring, analyzing and recovering are the three major steps for memory forensics. Experiments are performed with different tools to understand the procedure of acquiring, analyzing and recovering important evidences. Findings: The strengths and drawbacks of all the tools are analyzed that providesa better understanding of the working of the tools in specific scenarios. The tools like FtkImager and Belkasoft represent the data as a tree structure which makes it difficult to analyze the data. All the tools investigated are not entirely fitted for a particular situation hence; the investigation needs to rely on many tools that can retrieve useful information from the evidences. It is important to know the usefulness of a tool before it is applied to solve a crime. Although most of the tools are successful in providing reasonable evidence, no single tool is sufficient to complete the investigation. Improvements: Most of the tools work as passive agents that is it is left to the discretion of the investigator to analyze the evidences collected through different tools. The tools can be improved by combining it with machine learning techniques. This paper also discusses the improvements that can be done in order to make the working of the tools easier and yielding better results.

The possibility of in-memory computing with volatile memristive devices, namely, memristors requiring a power source to sustain their memory, is demonstrated. We have adopted a hysteretic graphene-based field emission structure as a prototype of volatile memristor, which is characterized by a non-pinched hysteresis loop. Memristive model of the structure is developed and used to simulate a polymorphic circuit implementing in-memory computing gates such as the material implication. Specific regions of parameter space realizing useful logic functions are identified. Our results are applicable to other realizations of volatile memory devices., Comment: 11 pages, 7 figures

The protection of the volatile memory data is an issue of crucial importance, since authentication credentials and cryptographic keys remain in the volatile memory. For this reason, the volatile memory has become a prime target for memory scrapers, which specifically target the volatile memory, in order to steal sensitive information, such as credit card numbers. This paper investigates security measures, to protect sensitive information in the volatile memory from disclosure attacks. Experimental analysis is performed to investigate whether the operating systems (Windows or Linux) perform data zeroization in the volatile memory. Results show that Windows kernel zeroize data after a process termination, while the Linux kernel does not. Next, we examine functions and software techniques in C/C++ programming language that can be used by developers to modify at process runtime the contents of the allocated blocks in the volatile memory. We have identified that only the Windows operating system provide a specific function named SecureZeroMemory that can reliably zeroize data. Finally, driven by the fact that malware scrapers primarily target web browsers, we examine whether it is feasible to extract authentication credentials from the volatile memory allocated by web browsers. The presented results show that in most cases we can successfully recover user authentication credentials from all the web browsers except when the user has closed the tab that used to access the website.

Persistent memory has the potential to become universal storage for memory and storage uses. Unfortunately, our current programming model is still only geared to a two-level storage model supporting different semantics to access volatile memory and non-volatile hard disk. This, however, leads a performance gap in accessing the same persistent memory stemming from the difference in the aforementioned semantics and the performance degradation introduced by not appropriately adapting to characteristics of SCM. We propose a general-purpose SCM-access methodology for persistent data on universal storage to hide such semantics difference. Specifically, we design the Persistent Memory Server Engine (PMSE), a special user-level process based on a unified optimization and transactional mechanism, that provides a group of general calls related to allocation, optimization, transactions of persistent memory and a fine-grained data abstraction for persisting data. Our prototype evaluation of PMSE shows that, compared to several state-of-the-art solutions at the file-system and persistent-heap levels, PMSE can provide 4X better performance than kernel-based persistent-memory file system, 1.7× and 1.5× better performance than user-level persistentmemory file system and persistent heap, under the write-intensive workloads. For traditional applications, applications with IOs achieve similar performance to those without IOs.

Permutation-based obfuscation has been exploited to protect hardware against cloning, overproduction, and reverse engineering with a secret key. In order to prevent key extraction from memory, this key is usually stored in volatile memory. Since the key is erased after the system loses power, this scheme is often considered the best way to prevent a key from being stolen since many attacks would require power. However, in this paper, we propose a new attack where the key is determined by exploring path aging within the permutation network used for obfuscation. Both the theoretical analysis and experimental results are provided. A practical procedure to achieve the proposed attack is also discussed in the context of an attacker's capabilities and knowledge. We also present an adjustment scheme to improve the accuracy of the attack. Various aging durations, process variations and measurement conditions are considered in our simulations. The experimental results show the accuracy of identifying the key is as high as 92.4% and more than enough to reduce the number of brute force combinations required by an attacker.

Digital investigation is becoming an increasing concern. Many digital forensic tools are being developed to deal with the challenge of investigating digital crimes. Acquisition of volatile memory is one of the vital steps of digital forensics process. Passwords data, indications of digital forensics methods, memory malware may be contained in volatile data which may overlooked by the investigator. The Success of memory acquisition mainly depends on the effectiveness of the memory acquisition tool. This paper compares memory forensics tools based on processing time and left artifacts on volatile memory. Furthermore, we examined how the processing time of the tools varies in terms of different volatile memory size. In order to conduct this work, we use the following tools: FTK Imager, Pro Discover, Nigilant32, Helix3(dd), OSForensics and Belkasoft RAM Capturer. The results show that Belkasoft RAM Capturer has the least amount of left artifacts, and it has also the lowest processing time. Moreover, this work concludes that tested tools are significantly different based on left artifacts on the volatile memory with 95% confidence level. Also, statistically, increasing the memory size × times does not increase the processing time × times of the tools.

The major disadvantages of DRAM memory cells are the very short retention time and high power consumption needed to refresh the stored information. Here, we present a new concept using a modified DRAM capacitor stack to enable non-volatile data storage. Recent reports verified anti-ferroelectric properties for pure ZrO 2 dielectrics used in DRAM stacks. Anti-ferroelectric materials are well known for high endurance strength but at the same time volatile memory behavior. Based on Landau theory, we propose a simple way how non-volatility can be achieved in state-of-the-art ZrO 2 based DRAM stacks. By employing electrodes with different workfunction values, a built-in bias is introduced within the AFE stack, thus creating two stable non-volatile states. Moreover, we report the fabrication of the world's first non-volatile AFE-RAM. Detailed characterization proved high endurance and reliable operation of this non-volatile DRAM stack equivalent. In addition to the 1T-1C cell, we show a proof of concept for a MIS capacitor device which can be integrated in future AFE-FET based 1T memory architectures.

Today, most organizations employ cloud computing environments for both computational reasons and for storing their critical files and data. Virtual servers are an example of widely used virtual resources provided by cloud computing architecture. Therefore, virtual servers are considered an attractive target for cyber-attackers, who launch their attacks by malware such as the well-known remote access trojans (RATs) and more modern malware such as ransomware and cryptojacking. Existing security solutions implemented on virtual servers fail to detect these newly created malware (zero-day attacks). In fact, by the time the security solution is updated, the organization has likely already been attacked. In this study, we present a designated framework aimed at trusted and secured detection of newly created and unknown instances of malware on virtual machines in an organization's private cloud. We took volatile memory dumps from a virtual machine (VM) in a secured and trusted manner, and analyzed all of the data within the memory dumps using the MinHash method; MinHash is well suited for the accurate detection of malware in VMs based on efficient volatile memory dump comparisons. The proposed framework is evaluated in a comprehensive set of experiments of increasing difficulty in which we also measured the detection performance of different classifiers (both similarity and machine learning-based classifiers, using collections of real-world, professional, notorious malware and legitimate applications. The evaluation results show that our framework can detect the anomalous state of a virtual server, as well as known, new, and unknown malware, with very high TPRs (100% for ransomware and RATs) and very low FPRs (1.8% for ransomware and no FPR for RATs). We also show how the methodology's performance can be improved, in terms of required time and storage space, saving more than 86% of these resources. Finally, we demonstrate the generalization capabilities and practicality of our methodology by using transfer learning and learning from just one virtual server in order to detect unknown malware on a different virtual server.

Due to the large gap in timescale between volatile memory and nonvolatile memory technologies, quasi-nonvolatile memory based on 2D materials has become a viable technology for filling the gap. By exploiting the elaborate energy band structure of 2D materials, a quasi-nonvolatile memory with symmetric ultrafast write-1 and erase-0 speeds and long refresh time is reported. Featuring the 2D semifloating gate architecture, an extrinsic p-n junction is used to charge or discharge the floating gate. Owing to the direct injection or recombination of charges from the floating gate electrode, the erasing speed is greatly enhanced to nanosecond timescale. Combined with the ultrafast write-1 speed, symmetric ultrafast operations on the nanosecond timescale are achieved, which are ≈106 times faster than other memories based on 2D materials. In addition, the refresh time after a write-1 operation is 219 times longer than that of dynamic random access memory. This performance suggests that quasi-nonvolatile memory has great potential to decrease power consumption originating from frequent refresh operations, and usher in the next generation of high-speed and low-power memory technology.

The application of IT in all industrial facilities has led to the use of special-purpose systems in diverse areas. As such, special-purpose systems have increasingly become the target or path of hacking attacks. From a digital forensics viewpoint, these systems can be used to gather evidence from all the relevant digital devices such as whole systems or storage units at the scene of a crime. Notably, In case of special-purpose embedded system, unlike a conventional computing system, is almost always ‘powered on’ like server, the accumulated data can remain in the volatile memory. This paper focuses on analyzing ways of gathering physical memory data for application in an embedded system and of developing a test system to analyze the physical memory for verification.

This paper presents organic based logic and memory circuits. All those circuits are made with organic N- and P-type transistors. Organic complementary NAND and NOR gates were characterized and show performance equivalent to or better than the literature-reported ones. The presented memory circuits include an SRAM memory point and an edge-triggered flip-flop. The flip-flop is made of six organic two-input and three-input NAND gates, representing a total of 26 organic transistors for a surface of 170 mm2. The maximum operating frequency of this flip-flop is 220 Hz under a supply of ±20 V. All the circuits were manufactured using a standard organic sheet-to-sheet process in ambient air. Electrical characteristics remain identical after repeated measurements. Finally, a model matching the presented circuits' behavior was carried out, permitting the design of more complex circuits.

Memory forensics and data carving methods are usually used during volatile investigation and is nowadays a big area of interest. Volatile memory dump is used for offline analysis of live data. Live analysis of the running system gives the information of which events are going on. Volatile memory analysis can give the sensitive information such as User Ids, Passwords, Hidden Processes, Root kits, Sockets etc. which are not stored on the physical drive. This Paper represents various approaches and tools used to capture and analyse data from computer memory.

The main feature of Flash Memory is that it can retain data when the power is shut down, which is an indispensable part of a modern electronic system. System designers benefited greatly when the electrically erased and programmed nonvolatile Flash Memory became available. DRAM has been mainly used for the main memory to store the data and program in the computer. DRAM is fast, however, it can no longer retain data when the power is shut down. It is called a volatile memory. Therefore, personal computers have external storage devices of Hard Disk Drive (HDD) at any cost. This replacement of HDD by Flash Memory has been just got started. Flash Memory has a variety of advantages; low cost, light, low power (eco-friendly), vibration free, and resistant to moisture, etc. These good points of Flash Memory have innovatively produced a digital camera, cellular phone, and removal storage card. And now, Solid State Disk (SSD) has been fed directly into a computer in the replacement of HDD.

Resistive-switching memories based on copolyimides (coPIs), PI-NTCDIX and PI-BTCDIX, with different compositions of 4,4′-diamino-4″-methyltriphenylamine (AMTPA), 4,4′-(hexafluoroisopropylidene)diphthalic anhydride, and N,N′-bis-(4-aminophenyl)-1,8:4,5-naphthalenetetracarboxydiimide (NTCDI) or N,N′-bis-(4-aminophenyl)-1,2:4,5-benzenetetracarboxydiimide (BTCDI) have been developed. By varying the feed ratio of monomers, PI-NTCDIX and PI-BTCDIX showed tunable optical and electronic properties through the charge transfer (CT) between AMTPA and NTCDI or BTCDI. The memory devices based on PI-NTCDIX exhibited the tunable electrical bistability from the volatile dynamic random access memory to nonvolatile write once read many memory characteristics as the NTCDI composition increased. The OFF/ON electrical switching transition was mainly attributed to the CT mechanism for the charge separated high conductance, based on the analysis of model compounds and density functional theory calculation. Also, the volatility of the memory device depended on the stability of CT complex. The long conjugation and high electron affinity of the NTCDI moiety stabilized the radical anion generated in the CT complex and prevented the recombination of segregated radical species even through applying the high positive or negative voltage. On the other hand, the memory devices based on PI-BTCDIX showed a rather unique behavior compared with those based on PI-NTCDIX. At the low BTCDI composition, the device exhibited volatile memory property. However, no switching behavior was observed at the high BTCDI composition due to the low highest occupied molecular orbital energy level of BTCDI. Combining these results and our previous study on perylenebisimide (PBI), we concluded that memory characteristics could be tailored by changing the conjugation length (PBI > NTCDI > BTCDI) and the acceptor composition in random coPIs. © 2012 Wiley Periodicals, Inc. J Polym Sci Part A: Polym Chem, 2013

In this paper, we model two-terminal all graphene quantum dot (GQD) based resistor-type memory devices (memristors). The resistive switching is achieved by resonant electron tunneling. We show that parallel GQDs can be used to create multi-state memory circuits. The number of states can be optimised with additional voltage sources, whilst the noise margin for each state can be controlled by appropriately choosing the branch resistance. A three-terminal GQD device configuration is also studied. The addition of an isolated gate terminal can be used to add further or modify the states of the memory device. The proposed devices provide a promising route towards volatile memory devices utilizing only atomically thin two-dimensional graphene.

Non-volatile memories (NVMs) such as Spin-Transfer Torque RAM (STTRAM) have drawn significant attention due to complete elimination of bitcell leakage. In addition to the plethora of benefits such as density, non-volatility, low-power and high speed, majority of Non-Volatile Memories (NVMs) are also compatible with CMOS technology enabling easy integration. Although promising, NVM brings new security challenges that were absent in their conventional volatile memory counterparts such as Static RAM (SRAM) and embedded Dynamic RAM (eDRAM). The root cause is persistent data that may allow the adversary to retrieve sensitive information like password or cryptographic keys. This is primarily due to the fundamental dependency of these memory technologies on environmental parameters such as magnetic fields and temperature which can be exploited by the adversary to tamper with the stored data. This paper investigates the data security and privacy challenges in NVMs by exploring the security specific properties and novel security primitives realized using spintronic building blocks. A thorough analysis is done on the vulnerabilities, data security and privacy issues, threats and possible countermeasures to enable safe computing environment using spintronics.

As a result of the rapid growth in popularity of portable digital devices in recent years, the power requirements for computer operating systems used in these devices have also rapidly increased as both their complexity and processing power have increased. Compared with systems based on DRAM as main memory, PCM (Phase change memory), a new memory technology, can significantly reduce power consumption because data stored in PCM does not disappear when the device is powered down. This paper will first discuss several PCM-RAM-based hybrid systems. In these systems, the amount of read-only data influences the design of the hybrid structure. In the experiment section, it was found that almost 80% of data was semi-read-only.

Android devices are widely used in the world and can function as GPS receivers. Time and position information have great relevance in investigation, however, data stored in non-volatile media may be limited with respect to the reconstruction of trajectories, since data from GPS receivers usually remains in RAM and is not written on log files, databases, and other artifacts. A prospective method for recovering data with GPS-coordinates stored in RAM memory of Android mobile devices is presented. Experiments were performed in different scenarios, with different device architectures, to analyze the feasibility of reconstruction of trajectories based on the NMEA 0183 protocol sentences retrieved from RAM memory. In developing the technique, it was possible to verify issues that can hinder the process of extraction and analysis of data and also assess tools that have been developed to aid the process.

With the popularity of smart phones and the emergence of the mobile office mode, the traditional email forensics that works for computer has been already unable to satisfy the demands of reality, so forensic work needs to be expanded to a range of mobile devices, such as mobile phone, tablet, etc. In this paper, we will focus on examining if we can discover email-related information in the volatile memory of the mobile phone. Specifically, we choose Android mobile as a research focus, and two Chinese mainstream Android email applications—MailMaster and QQMail are as email client to the experimental test. Finally, we not only sort out the email-related information stored in the volatile memory, but also identify the patterns of the information saved in the memory. Moreover, based on these patterns, we also develop a tool named EmailFinder that can automatically extract the email-related information from memory dump. It can be utilized as a forensic tool on Android phones to assist forensic investigators retrieve email-related evidence from memory dump.

Reversible logic is an emerging technology with wide spread applications in the field of digital systems. The term RAM refers to memory that is accessed with an address and has latency independent of address. In semiconductor memories RAM usually refers to volatile memory read/write memory as opposed to ROM (read only memory). The 2n×2m×1 RAM has n rows and m columns, out of which one bit is selected as an output. The design of proposed ram requires write/read enabled FF for information read and write and address decoding circuit. The paper uses the reversible modified Frekdin gate to propose an address decoder and write enabled master slave D FF. The proposed designs are optimized in terms of quantum cost. The proposed designs are used for implementation of 2n×2m×1 reversible RAM. Several theorems related to Decoders and 2n×2m×1 reversible RAM are suggested and proved.