/projects/memory-triage-app
MemTriage: Evidence-Linked Memory Analysis Workspace
A full-stack memory-triage workspace that joins VolMemLyzer evidence, tunable ATT&CK-aligned scoring, process inventory, and VADViT explanations in one exportable investigation.
Overview
MemTriage turns one raw memory image, or a short sequence of snapshots from the same host, into a consolidated investigation. It combines broad Volatility-based artifact extraction with analyst-selected VADViT analysis so automated triage and model output remain tied to named processes and source evidence.
Analyst problem
Memory-forensics tools often expose either a large volume of plugin output or a narrow classifier verdict. Analysts still need to establish process context, correlate evidence across sources, decide where deeper analysis is warranted, and retain an explainable record of that decision. MemTriage organizes those stages into one workspace.
My role
I designed and implemented the application architecture, API and worker workflow, evidence scoring, forensic adapters, VAD-region processing, model integration, explainability output, React analyst experience, demo mode, deployment stack, and security controls around untrusted memory images.
Two-phase investigation
The first phase fingerprints every upload, runs VolMemLyzer against the primary snapshot, builds an artifact dashboard, and creates a process/PID inventory. The analyst then selects a process for deeper analysis rather than running an expensive model indiscriminately.
The second phase extracts the selected process's VAD regions from each snapshot, chooses the snapshot with the richest region set, renders the VADViT grid, classifies the process, and maps attention back to specific regions. Repeated process analyses are folded into one investigation result.
Explainable and tunable scoring
The scoring engine operates over cached Volatility artifacts. Rules describe identity, ATT&CK alignment, data sources, severity, source confidence, and a pure evaluation predicate. Every score contribution retains the rule and concrete evidence that produced it. Sensitivity presets and per-rule controls can rescore an investigation without rerunning Volatility, while the UI highlights what changed.
Application architecture
FastAPI exposes investigation, process, result, scoring, and event routes. Celery and Redis coordinate long-running forensic work, PostgreSQL stores investigation state, and a React/TypeScript workspace guides the analyst through ingest, triage, inventory, deep dive, and report stages. Docker Compose packages the complete local stack.
Untrusted-input controls
Uploads stream to disk with extension, magic-byte, count, and size checks. Dump-derived text is sanitized before persistence or rendering. The worker that parses memory images runs on an internal network with no internet egress, dropped Linux capabilities, no privilege escalation, and bounded memory.
Honest model degradation
If a VADViT checkpoint or compatible runtime is unavailable, the classifier returns an explicit unavailable result instead of inventing a verdict. Attention overlays are generated only when a real model result and renderable VAD grid exist. Demo fixtures are isolated from live execution and visibly identified in the interface.
Verification
The backend test suite covers the API lifecycle, upload security, forensic parsing, scoring behavior, live rescoring, deterministic grid generation, model degradation, attention attribution, and output sanitization. The repository also includes a no-backend demo path for reviewing the complete analyst workflow.
Current limits
MemTriage is a work-in-progress security-engineering demonstration, not an EDR replacement or continuous-monitoring product. It depends on Volatility symbol and plugin behavior, and real VADViT verdicts require a compatible checkpoint. Automated scores and attention maps remain investigative leads that require analyst validation.