Scholarlink

<p>Understanding the behavior of an investigator-selected process from a volatile memory dump remains a significant challenge in digital forensics. Existing memory-forensics tools primarily expose low-level artifacts, requiring substantial analyst effort to translate them into meaningful behavioral understanding. This paper presents a five-phase AI-assisted framework for process-level semantic reconstruction from memory dumps. The framework uses Volatility 3 plugins to collect system-wide and per-process artifacts, correlates them into structured process profiles, and optionally enriches them with filtered memory-resident strings. Large language models (LLMs), including ChatGPT and Gemini, are then used to generate higher-level behavioral interpretations from these profiles. The framework is evaluated through controlled experiments using synthetic processes with diverse runtime behaviors. A focused robustness analysis further examines how prompt design, evidence source, repeated runs, and model choice affect interpretation quality. The results suggest that structured forensic profiles can support useful LLM-assisted interpretation of selected process behavior, while evidence grounding, overclaim control, and specificity remain dependent on prompt structure and evidence input. Overall, the study positions AI-assisted semantic interpretation as an analyst-support layer for process-level memory-forensic analysis, while making its operating assumptions and limitations explicit.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

AI-assisted semantic reconstruction of process behavior from memory dumps

  • 期刊论文

  • 发表日期：

    2026年6月30日

查看全文
  • Mohammed I. Al-Saleh,
  • Akram Alkouz,
  • Abdulsalam Alarabeyyat

摘要

Understanding the behavior of an investigator-selected process from a volatile memory dump remains a significant challenge in digital forensics. Existing memory-forensics tools primarily expose low-level artifacts, requiring substantial analyst effort to translate them into meaningful behavioral understanding. This paper presents a five-phase AI-assisted framework for process-level semantic reconstruction from memory dumps. The framework uses Volatility 3 plugins to collect system-wide and per-process artifacts, correlates them into structured process profiles, and optionally enriches them with filtered memory-resident strings. Large language models (LLMs), including ChatGPT and Gemini, are then used to generate higher-level behavioral interpretations from these profiles. The framework is evaluated through controlled experiments using synthetic processes with diverse runtime behaviors. A focused robustness analysis further examines how prompt design, evidence source, repeated runs, and model choice affect interpretation quality. The results suggest that structured forensic profiles can support useful LLM-assisted interpretation of selected process behavior, while evidence grounding, overclaim control, and specificity remain dependent on prompt structure and evidence input. Overall, the study positions AI-assisted semantic interpretation as an analyst-support layer for process-level memory-forensic analysis, while making its operating assumptions and limitations explicit.