Digital forensics is the process of extracting, preserving, and documenting evidence in digital devices. A commonly used method in digital forensics is to extract data from the main memory of a digital device. However, the main challenge is identifying the important data to be extracted. Several pieces of crucial information reside in the main memory, like usernames, passwords, and cryptographic keys such as SSH session keys. In this paper, we propose SmartKex, a machine-learning assisted method to extract session keys from heap memory snapshots of an OpenSSH process. In addition, we release an openly available dataset and the corresponding toolchain for creating additional data. Finally, we compare SmartKex with naive brute-force methods and empirically show that SmartKex can extract the session keys with high accuracy and high throughput. With the provided resources, we intend to strengthen the research on the intersection between digital forensics, cybersecurity, and machine learning.

翻译：数字法证是数字设备中提取、保存和记录证据的过程。数字法证中常用的方法是从数字设备的主要记忆中提取数据。然而,主要挑战是确定要提取的重要数据。一些关键信息存在于主要记忆中,如用户名、密码和SSH会话键等密码键。在本文中,我们提议SmartKex,这是一个机械学习辅助方法,从 OpenSSH 过程的堆积记忆快照中提取会话键。此外,我们公布一个公开可得的数据集和相应的工具链,用于创建额外数据。最后,我们将SmartKex与天真的粗力方法进行比较,并用经验显示SmartKex能够以高精度和高量量提取会话键。我们打算利用所提供的资源,加强关于数字法证、网络和机器学习之间交叉点的研究。