Email spoofing detection using volatile memory forensics

In email systems, one of the most widely used attacks is email spoofing, in which the source address of the email message is forged to make the recipient of the email believe that the email was sent from a legitimate source. Several research works have been presented in the past to address email spoofing attack. Further, in recent years, the technique of memory forensics has evolved significantly where critical evidence is extracted from the volatile memory of the target machine during a cyber crime investigation. In this paper, we utilize memory forensics to detect if the client received any spoofed email. In addition, our memory forensics approach detects if the client replied to any spoofed emails. The memory of the client machine is acquired on a scheduled basis and the acquired memory dump is analyzed to identify spoofing attack and, if detected, storing the details in log files that can be used by cyber crime investigators. The benefit of applying memory forensics to detect spoofed emails is that it guarantees non-repudiation since every action performed on a computer is loaded in the system's physical memory, including email communication, and hence the user cannot deny receiving or replying to spoofed email.