/projects/vadvit-explainable-memory-forensics
VADViT: Explainable Malicious-Process Detection from Memory
A Vision Transformer pipeline that converts Virtual Address Descriptor regions from Windows memory snapshots into fused Markov, entropy, and metadata images for malicious-process detection and region-level attribution.
Overview
VADViT turns Windows process-memory evidence into a structured visual representation for detection and forensic review. Rather than reducing an entire dump to one image, the pipeline extracts Virtual Address Descriptor regions, follows them across snapshots, and preserves region-level structure in a process grid.
Research problem
Memory-based malware detectors often depend on handcrafted features or aggressive image resizing. Those choices can discard local evidence and make a model's decision difficult to investigate. VADViT asks whether region-aware visual representations and transformer attention can support both classification and analyst-oriented attribution.
My role
I designed and implemented the main VADViT research pipeline, including VAD-region extraction, temporal aggregation, memory-region visualization, process-grid construction, Vision Transformer training, evaluation, and attention-based forensic attribution. I also contributed to dataset design, experimental analysis, and publication writing.
Dataset and snapshot workflow
The work uses BCCC-MalMem-SnapLog-2025, which captures memory snapshots at regular intervals while logging process identifiers and supporting host and network telemetry. The workflow isolates relevant process memory without requiring a debugger attachment during later forensic analysis.
VAD extraction and temporal aggregation
Volatility 3 extracts VAD regions for tracked processes. The preprocessing pipeline consolidates related regions across snapshots so the representation captures changes in process memory while retaining the identity of individual regions.
Fused memory representation
Each region contributes three complementary channels:
- a Markov byte-transition image representing local byte relationships;
- an entropy image exposing randomness and packed or encrypted areas;
- an intensity image encoding VAD metadata and permissions.
The regions are placed into a process grid before Vision Transformer training. This keeps region boundaries available to the model instead of flattening the process into one undifferentiated image.
Attention-based forensic attribution
Self-attention scores are mapped back to VAD regions and sorted to identify the memory areas most relevant to a prediction. The output is an investigative lead: analysts can prioritize suspicious allocations, injected-code candidates, and unusual permission patterns while retaining the underlying evidence.
Evaluation and results
The final peer-reviewed evaluation reports 99% binary classification accuracy and 92% macro-averaged F1 for multiclass detection. The paper also evaluates image resolution, patch size, freezing strategies, and variability across random-seed runs.
Limitations
The reported results are tied to the study's Windows memory dataset and malware-family coverage. Attention prioritization supports interpretation but does not prove causality or replace manual forensic validation. Broader external datasets and evolving operating-system memory structures remain important validation targets.