VADViT: Vision transformer-driven memory forensics for malicious process detection and explainable threat attribution

Modern malware’s increasing complexity limits traditional signature- and heuristic-based detection, necessitating advanced memory forensic techniques. Machine learning methods have been explored, but many rely on outdated feature sets and require significant domain knowledge for feature extraction. Also, handling large-scale memory data — especially in image-based approaches — poses challenges in efficiency and forensic explainability. We propose VADViT, a vision transformer-based model for detecting malicious processes by analyzing Virtual Address Descriptor (VAD) memory regions to address these limitations. VADViT transforms these regions into fused Markov, entropy, and intensity images, enabling effective classification using a Vision Transformer (ViT) with self-attention mechanisms. We also introduce BCCC-MalMem-SnapLog-2025, a new dataset that captures memory dumps at regular intervals and logs PIDs, enabling precise VAD extraction without relying on dynamic analysis. VADViT achieves 99% accuracy in binary classification and a 92% macro-averaged F1 score in multi-class detection. Attention-based sorting of VAD regions further improves forensic efficiency by narrowing the analysis scope to the most relevant memory areas.