ML2
Peer-reviewed papers
Applied AI & ML
Published malware-detection research spanning classification, explainability, and error analysis.
Hey there.
Yasin Dehfouli
Applied AI / ML · Security Engineering & Detection
I like taking applied machine-learning work from a research question to something people can inspect: the data, evaluation, failure cases, and code. Most of my work sits in malware analysis, detection engineering, and memory forensics.
2 peer-reviewed publicationsOpen-source code and reports
DEMerged
Upstream detection correction
Detection Engineering
Found a hash-semantics defect in a public detection and contributed the correction upstream.
Who I am
About
Applied machine learning is the starting point of my work: model training, multiclass evaluation, attention analysis, and research publication. Detection engineering and digital forensics provide the systems and evidence I apply it to.
AI security is the intersection, where adversarial behavior, uncertain evidence, and system changes matter. The project pages document the setup, results, and limitations so each claim can be checked.
DFBuilt
Evidence scoring for memory investigations
Digital Forensics
Turned raw memory artifacts into bounded, explainable findings for analyst review.
ASTested
Security agents under prompt injection
AI Security
Built reproducible adversarial tests with realistic telemetry placement, baselines, and auditable traces.
Selected work
Selected projects
A short account of what each project does and what the documented evaluation found. Open a project for the method, results, limitations, code, and reports.
ML
Applied ML · Malware analysis
VADViT
A Vision Transformer study for binary malware detection and nine-family classification, published in the Journal of Information Security and Applications.
99.2%Binary accuracy
0.92Nine-class macro-F1
2,014Retained samples
- Binary detection and malware-family classification in one documented evaluation.
- Top-five attention-region entropy precision of 0.87, compared with a 0.18 global baseline.
Vision TransformerMalwareAttention analysis
Open research report DE
Detection engineering · Evaluation
Detection Under Load
A controlled harness for measuring whether published detection rules still match after observable details of an attack are changed.
80Published rules
354kAttack events
35→15Matches after mutations
- Seven tools and implementations exercised against the documented attack run.
- Renaming alone removed 12 of 35 baseline detections before relocation was tested.
SigmaWindows telemetryMutation testing
Open research report 03
Agent Under Load
↗A LangGraph triage agent tested to see whether its verdict follows Windows telemetry when the alert stays fixed.
AI
Agentic AI · Evidence evaluation
Agent Under Load
A LangGraph triage agent tested to see whether its verdict follows Windows telemetry when the alert stays fixed.
0.72Within-rule macro-F1
+0.40Gain from telemetry
4Models evaluated
- Scoped tools, structured verdicts, citations, and audit trails make each investigation inspectable.
- The paired within-rule study separates evidence use from the alert's own signal.
LangGraphAgent evaluationAI security
Open research report 04
VolMemLyzer3
↗520 memory-analysis features across 51 groups, with a measured 2.4× parallel speedup.
DF
Digital forensics · Automation
VolMemLyzer3
520 memory-analysis features across 51 groups, with a measured 2.4× parallel speedup.
520Analysis features
51Feature groups
2.4×Parallel speedup
- Registry-driven extraction with cached and parallel Volatility plugin execution.
- Structured artifacts remain linked to the underlying commands and evidence.
PythonVolatility 3DFIR
Open technical report 05
MemTriage
↗An analyst workspace for VolMemLyzer evidence, explainable scoring, VADViT attribution, and region review.
IR
Incident response · Memory analysis
MemTriage
An analyst workspace for VolMemLyzer evidence, explainable scoring, VADViT attribution, and region review.
27Enabled scoring rules
5Default snapshot limit
520Available features
- Cached forensic artifacts can be rescored without rerunning Volatility.
- Selected regions open into disassembly, CFG, FCG, pattern, structure, and bounded byte views.
FastAPIReactVolatility 3
Open investigation report View all projects →Code · reports · papers
Working toolkit
Skills
The languages, methods, and systems I use across applied ML and security engineering.
01
Applied AI & ML
- Python
- PyTorch
- scikit-learn
- Vision Transformers
- Graph neural networks
02
Detection & Security
- Detection engineering
- Sigma
- SIEM
- MITRE ATT&CK
- Security telemetry
03
DFIR & Malware
- Memory forensics
- Volatility 3
- Malware analysis
- Incident response
- VAD analysis
04
Software & Systems
- TypeScript
- React
- FastAPI
- SQL
- Linux
05
Delivery & Infrastructure
- Docker
- GitHub Actions
- PostgreSQL
- Redis
Publications
Peer-reviewed research
Published work on machine learning for malware analysis and memory forensics.
2025 · JISADOI ↗2025 · CSURDOI ↗
VADViT: Vision transformer-driven memory forensics for malicious process detection and explainable threat attribution
Journal of Information Security and Applications
Memory Analysis for Malware Detection: A Comprehensive Survey Using the OSCAR Methodology
ACM Computing Surveys
Recognition
Selected honors
Academic distinctions relevant to the research record.
Nationwide rank
Nationwide University Entrance Examination
Ranked 112 (top 0.05%) in Iran's nationwide university entrance examination among 300,000 participants.
Academic distinction
Best Master's Thesis Award Nomination
Among the theses in York University's Electrical Engineering and Computer Science department.
Graduate funding
Graduate Fellowship and Fully Funded Admissions
$67,500 York University Graduate Fellowship, with full-scholarship admissions from UCI, IIT, Drexel, and Western Ontario.
Long-term fellowship
National Elite Foundation Fellowship
Awarded in Iran for sustained academic excellence.