HOLMES: Artificial Intelligence Enabled Expert System for Efficient Acquisition and Analysis Using Live Memory Forensics

The recent adoption of autonomous systems in supply chain management has increased the need of security, vigilance and timely reporting of malicious patterns in order to prevent greater harm to the stakeholders. Sensitive data related to supply chain is stored in volatile memory which is lost whenever the systems are powered down; leaving the forensic investigators unaware about the nature of attack or type of malware affecting the supply chain. By using live memory forensics, such kind of threats can be analyzed in a better way. The volatile memory of target(s) can be acquired and analyzed to report security incidents in timely manner for further investigation. However, the process of live memory forensics can be very challenging considering the heterogeneous sources of data and the huge corpus of data to be analyzed. In this study, we propose a novel model for an efficient memory acquisition and analysis process by using artificial intelligence to automate and make the analysis more accurate leading to faster, optimized and more secure supply chains. This work also discusses the need and challenges related to live memory forensics in the milieu of supply chain management along with the benefits of using this model as a part of forensic readiness for mission critical and sensitive supply chains. We conclude our work with recommendations for conducting future work in this area.