Memory forensics · process memory · explainable threat attribution
Classify the process — then show the analyst where in memory to look.
VADViT converts a Windows process's Virtual Address Descriptor regions into structured images, classifies the resulting process representation with a Vision Transformer, and maps attention back to the VAD regions that most influenced the result.
The forensic problem
Memory has the evidence. The difficulty is finding the few regions worth inspecting.
A full RAM capture contains many processes, and every process can contain many memory ranges. Traditional whole-dump visualization loses process identity; manual region-by-region inspection does not scale. VADViT keeps the process boundary and the memory-region boundary intact so a model verdict can still be traced back to concrete virtual-address ranges.
Preserve process context
The workflow isolates the target process by PID and extracts its VAD tree rather than flattening the entire memory image.
Preserve complementary evidence
Byte transitions, local entropy, and VAD allocation semantics are encoded as separate channels instead of collapsed into one grayscale view.
Return to evidence
Transformer patches retain a one-to-one relationship with VAD-region slots, allowing attention to be mapped back to addresses for follow-up.
End-to-end method
Five snapshots become one process-level memory representation.
The study captures up to five memory snapshots at 30-second intervals, extracts the target process's VAD regions with Volatility 3, aggregates regions across snapshots, removes stack/heap regions from the model input, creates region images, and assembles them into a fixed process grid for ViT classification.
Published methodology: periodic process memory snapshots → VAD extraction and aggregation → region encoding → process grid → Vision Transformer → attention-guided region review.
vadinfo --dumpRegion representation
One VAD region is encoded three different ways before fusion.
The channels answer different forensic questions. Markov structure captures which bytes tend to follow which; entropy captures byte-value randomness; custom intensity encodes memory-allocation semantics that raw bytes alone do not contain.
Markov · blue
A 256×256 transition matrix models first-order byte transitions. The enhanced image preserves lower-frequency structure that would otherwise be visually suppressed.
Entropy · green
Dynamic windows produce a fixed-size Shannon-entropy image without forcing arbitrary fixed windows across regions of very different sizes.
Intensity · red
VAD tag, page protection, and private/shared allocation state are converted into a semantic intensity channel and normalized before fusion.
Each dumped VAD region becomes an RGB tile: Markov → blue, entropy → green, custom VAD intensity → red.
Process representation
Region order is preserved so a model patch can still mean a memory region.
Executable regions are placed first in ascending virtual-address order, followed by DLL-backed regions in ascending address order. Empty cells are zero-padded. The process grid is then divided into ViT patches; with the selected 224×224 image and 32×32 patch configuration, the grid contains 49 patch slots.
Why ViT
VAD regions are disjoint in virtual memory. A flat self-attention architecture can model relationships between non-adjacent regions without assuming the local continuity of a convolutional image.
Published backbone
ViT-Base: 12 Transformer blocks, 12 attention heads, hidden dimension 768, MLP size 3072, approximately 88 million parameters, pretrained on ImageNet-1K.
Published experiments
The strongest configuration favors larger patches, not a larger canvas.
The experiments vary image resolution, patch size, and gradual unfreezing. The strongest binary configuration uses 224×224 images, 32×32 patches, six initially frozen blocks, and three unfreezing steps.
Best reported metrics
| Task | Metric | Result |
|---|---|---|
| Binary | Accuracy | 99.2% |
| Binary | Macro-F1 | 0.96 |
| Binary | AUC | 0.993 |
| 9-class | Accuracy | 0.92 |
| 9-class | Macro precision / recall / F1 | 0.92 / 0.92 / 0.92 |
Best multiclass configuration
| Class | Precision | Recall | F1 |
|---|---|---|---|
| Benign | .93 | 1.00 | .96 |
| HackTool | 1.00 | .90 | .95 |
| Rootkit | .95 | 1.00 | .97 |
| Trojan | .81 | .81 | .81 |
| Macro avg | .92 | .92 | .92 |
Trojan remains the weakest family in the selected model, reflecting overlap with loader/injection patterns in other families and sparse snapshot histories.
Published comparison across image size, patch size, and freezing strategies.
Training and validation progression for the selected multiclass experiment.
Ablation
All three channels are required for stable performance.
| Channels | Accuracy | Macro-F1 | Interpretation |
|---|---|---|---|
| Markov + Entropy + Intensity | 0.99 | 0.96 | Full representation |
| Intensity + Entropy | 0.89 | 0.74 | Short-lived improvement after unfreezing, then instability |
| Entropy + Markov | 0.88 | 0.73 | Similar temporary signal, weaker generalization |
| Markov + Intensity | 0.48 | 0.48 | Loss of entropy diversity causes near-majority-class collapse |
Representative two-channel inputs. The third RGB slot is zero-padded in the paper's ablation setup.
Forensic analyst view
The output can be traced from a model patch back to a virtual address.
VADViT registers a forward hook on the final self-attention block. The resulting class-token attention is overlaid on the process grid. Because grid cells correspond to VAD-region slots, the highest-attention cells can be mapped back to their region filenames and addresses for disassembly or byte inspection.
Published attention examples: a strongly attended region and a moderately attended region from process-level VAD grids.
Classify
Raise the process for review rather than forcing an analyst to inspect every region first.
Rank
Sort grid cells by attention weight and recover the source VAD-region order.
Map
Resolve the selected region back to its virtual address and dumped bytes.
Inspect
Open the raw region in a disassembler, hex viewer, or other forensic tool.
Most-attended VAD region in the paper's HackTool sanity check, shown as raw bytes and Capstone disassembly.
What the example contains
The reported highly attended region begins with a shellcode-style stub: pushad, pushfd, and a jump over embedded high-entropy bytes, followed by a call/pop eax pattern used for position-independent base-address recovery.
Quantitative attention sanity check
Entropy precision uses the paper's 7.1 bits/byte high-entropy threshold. It is a sanity check on what attention localizes, not a proof that attention explains model causality.
Dataset
The study captures process memory over time rather than relying on one static snapshot.
BCCC-MalMem-SnapLog-2025 begins with 2,000 malware samples across eight categories and 250 benign samples. The capture workflow tracks the process PID, acquires memory at 30-second intervals, and records network and Windows logs alongside memory. Timeout samples without extractable VADs are excluded, leaving 2,014 retained samples for the published model experiments.
Automated dataset acquisition workflow: clean VM state, malware execution, PID signaling, periodic memory capture, logging, shutdown and reset.
Study corpus
| Malware inputs | 2,000 |
|---|---|
| Benign inputs | 250 |
| Malware categories | 8 |
| Retained after timeout filtering | 2,014 total |
| Capture cadence | 30 seconds |
| Snapshots | up to 5 per sample |
| Published split | 80 / 10 / 10 |
The paper's data-availability section names the broader multi-source dataset BCCC-Mal-NetMem-2025 and states that the ~40 TB raw collection is available to academic researchers on reasonable request under non-commercial handling conditions.
Deployment characteristics
Inference is cheap; forensic preprocessing dominates wall-clock.
Training
On the reported GTX-1060, 36 epochs take about 18 minutes at 224² and 32 minutes at 384² with batch size 1.
Inference
The 200-snapshot test set is classified in 2.4 seconds: roughly 12 ms per image, with about 0.8 GB GPU memory.
End to end
The paper gives ~60 seconds as a lower-bound example for a 4 GB dump: ~10 s Volatility extraction + up to ~50 s visualization + ~12 ms classification.
The 60-second figure is not a universal runtime. Preprocessing scales with dump size, candidate process count, and the number of VAD regions.
Reference implementation
Reproduction requires the data and a deliberate configuration pass.
The public repository contains preprocessing, training, evaluation, and attention-visualization code. It does not bundle the raw memory corpus or trained checkpoints.
Environment check
python3.10 -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt
python test.py --help
python sample_test.py --helpPipeline
cd "Data Preprocessing/Dumps_to_Cnosolidated"
python main.py
cd "../Consolidated_to_Grid"
python main.py
cd ../..
python train.py
python test.py
python test.py --explainClaim boundaries
What the results do — and do not — establish.
Postmortem research workflow
VADViT is not an EDR, antivirus engine, or live endpoint monitor.
PID visibility matters
The process must be visible when memory is captured; short-lived helpers can be missed.
30-second cadence
Short-lived injections, wipes, or remaps can occur between snapshots.
Windows scope
The current extractor targets 64-bit Windows memory, not Linux or macOS.
Family overlap
Trojan classification remains challenging where loaders, packers, encryption, and injection stubs resemble other families.
Attention is prioritization
A highly attended region is a review target, not proof of malicious intent or a causal explanation of the model.
Publication
VADViT — JISA 2025
Yasin Dehfouli and Arash Habibi Lashkari, “VADViT: Vision transformer-driven memory forensics for malicious process detection and explainable threat attribution,” Journal of Information Security and Applications, vol. 94, 104200, 2025.