VADViT:Vision Transformer-Driven Memory Forensics for Malicious Process Detection and Explainable Threat Attribution

Modern malware's increasing complexity limits traditional signature and heuristic-based detection, necessitating advanced memory forensic techniques. Machine learning offers potential but struggles with outdated feature sets, large memory data handling, and forensic explainability. To address these challenges, we propose VADViT, a vision-based transformer model that detects malicious processes by analyzing Virtual Address Descriptor (VAD) memory regions. VADViT converts these structures into Markov, entropy, and intensity-based images, classifying them using a Vision Transformer (ViT) with self-attention to enhance detection accuracy. We also introduce BCCC-MalMem-SnapLog-2025, a dataset logging process identifier (PID) for precise VAD extraction without dynamic analysis. Experimental results show 99% accuracy in binary classification and a 93% macro-average F1 score in multi-class detection. Additionally, attention-based sorting improves forensic analysis by ranking the most relevant malicious VAD regions, narrowing down the search space for forensic investigators.

Author dc:creator

• Dehfouli, Yasin

Advisor dc:contributor.advisor

• Habibi Lashkari, Arash

• Artificial intelligence
• Computer science
• Computer engineering

Statement dc:rights

• Author owns copyright, except where explicitly noted. Please contact the author directly with licensing requests.

Language dc:language

en

Handle dc:identifier.uri

https://hdl.handle.net/10315/43048

OAI identifier oai:identifier

oai:yorkspace.library.yorku.ca:10315/43048