ML-based Fileless Malware Threats Analysis for the Detection of Cyber security Attack based on Memory Forensics: A Survey

The rapid advancements in cyber-attack strategies are in parallel with the measures for detection, analysis, and prevention. Attackers have recently developed fileless malware that can simply bypass existing security mechanisms. The high complexity of malware and the attacks rises in today’s world because malware increases the chance of cyberwar in many countries, the rise of one of the most sophisticated fileless malware is now increasing day by day and the present challenges for traditional malware detection and analysis are used that does not provide the complete information on Fileless malware. It evades conventional signature and firewall detection systems by hiding and directly injecting its malicious code into RAM, leaving no or minimum traces on the file system. This review paper explores the crucial artifacts in memory forensics that lead to a critical approach to addressing the challenges mentioned so that the investigator can detect and analyze the critical threats. Also, it highlights the method that helps the investigators analyze every aspect of the malicious or embedded code. This will help us to improve the detection criteria and the accuracy of the results. This study also helps the examiners in the examination of the processes and different types of analysis i.e. strings, anomaly detection, and the critical techniques used for retrieving malware artifacts. This review also includes the limitations of the existing tools and methodologies and the new evolving techniques and tactics used by the malware to hide its footprints. By identifying these gaps these papers provide robust farmwork for the enhancement of malware analysis tools and procedures to help the examiners in the analysis and examination of malware