Benign labels unverified in graph-based memory forensics
Original title: When Benign Is Unverified: Label-Signal Mismatch and Abstention-First Triage in Graph-Based Memory Forensics
Graph-based triage on MalVol-25 flags controls as high risk, revealing label-signal mismatch.
Validation study of graph-based triage pipeline for Windows memory images shows contradictions in benign labels on every control. Mean injection and command-and-control counts higher on controls than infected captures. Fusion path sends 97.7% of snapshots to analyst review.
- 15/15 and 18/18 controls flagged as HIGH or CRITICAL
- Benign class is unverified
- Leave-one-family-out AUROC equals logistic model
- 97.7% of snapshots to analyst review
- Same defect on CIC-MalMem-2022 and Sihwail corpora
From the original article
1 min read at arxiv.orgMachine-learning triage for memory forensics is usually validated on corpora whose benign class is asserted by provenance and never verified. We report a validation study of a graph-based triage pipeline for Windows memory images: Volatility 3 output is compiled into typed heterogeneous graphs and scored by a temperature-scaled GINE classifier and two one-class encoders, fused with rule risk under an abstention gate.
By Viraj Rajeshbhai Chudasama · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.