# A proactive malicious software identification approach for digital forensic examiners

arXiv: https://arxiv.org/abs/2109.09567 · HTML: https://mlsanity.com/paper/2109.09567/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 1 of its 85 references that are in the map.
- First posted on arXiv 20 Sep 2021.

## Builds on (most cited first, 1 of 1)

- [Agent-based Vs Agent-less Sandbox for Dynamic Behavioral Analysis](https://mlsanity.com/paper/1904.02100/) (2019)

## Built on by (most cited first, 1 of 1)

- [Enhancing Malware Detection by Integrating Machine Learning with Cuckoo Sandbox](https://mlsanity.com/paper/2311.04372/) (2023)

## Abstract (arXiv)

Digital investigators often get involved with cases, which seemingly point the responsibility to the person to which the computer belongs, but after a thorough examination malware is proven to be the cause, causing loss of precious time. Whilst Anti-Virus (AV) software can assist the investigator in identifying the presence of malware, with the increase in zero-day attacks and errors that exist in AV tools, this is something that cannot be relied upon. The aim of this paper is to investigate the behaviour of malware upon various Windows operating system versions in order to determine and correlate the relationship between malicious software and OS artifacts. This will enable an investigator to be more efficient in identifying the presence of new malware and provide a starting point for further investigation.