/publications/vadvit-vision-transformer-memory-forensics
VADViT: Vision transformer-driven memory forensics for malicious process detection and explainable threat attribution
A Vision Transformer framework for detecting malicious processes from VAD-region memory representations and attributing predictions to analyst-reviewable regions.
Citation
Yasin Dehfouli and Arash Habibi Lashkari. “VADViT: Vision transformer-driven memory forensics for malicious process detection and explainable threat attribution.” Journal of Information Security and Applications, Volume 94, Article 104200. 2025. doi:10.1016/j.jisa.2025.104200.Citation
Yasin Dehfouli and Arash Habibi Lashkari. “VADViT: Vision transformer-driven memory forensics for malicious process detection and explainable threat attribution.” Journal of Information Security and Applications, Volume 94, Article 104200, 2025. https://doi.org/10.1016/j.jisa.2025.104200
Plain-language summary
VADViT detects malicious Windows processes by converting their Virtual Address Descriptor regions into structured images. It combines three signals—byte transitions, entropy, and memory-region metadata—then uses a Vision Transformer to classify the process and rank the regions that most influenced the result.
Research problem
Existing memory detectors can depend on handcrafted forensic features, lose evidence while resizing large memory images, or return predictions without a practical route back to the suspicious bytes. The study focuses on preserving region structure and making model output useful during forensic review.
Methodology
The work introduces BCCC-MalMem-SnapLog-2025, a dataset built from periodic memory snapshots with process identifiers and supporting telemetry. Volatility 3 extracts the VAD regions for tracked processes. Each region becomes a fused Markov, entropy, and VAD-metadata image before placement in a process grid and classification by a fine-tuned Vision Transformer.
Main contributions
- a region-aware memory representation that limits information loss;
- a temporal memory-snapshot dataset with process-level tracking;
- an attention-based workflow that maps model relevance back to VAD regions;
- evaluation across binary and malware-family classification settings.
Headline results
The final paper reports 99% binary classification accuracy and 92% macro-averaged F1 for multiclass detection. Attention-based region sorting narrows the evidence analysts need to inspect while retaining links to the underlying memory regions.
Dataset context and limitations
The dataset represents controlled Windows malware executions and a defined set of families. Results may change with unseen environments, operating-system versions, acquisition conditions, and malware distributions. Attention ranking improves traceability but remains supporting evidence rather than a causal explanation.