A study on the live forensic techniques for anomaly detection in user terminals

Abstract

Digital forensics techniques that have been used to analyze system intrusion incidents traditionally are used to detect anomaly behavior that may occur in the user terminal environment. Particularly, for the method to analyze user terminals, automated live forensics techniques that are used as supporting tool for malicious code (malware) detection. We suggest a way to take advantage of the live forensic techniques for the anomaly detection of malware.