Search papers, labs, and topics across Lattice.
This paper introduces an explainable AI-assisted memory forensics approach using LLMs to interpret memory analysis outputs and extract Indicators of Compromise (IoCs) from Windows and Android malware. The approach aims to address the lack of interpretability in existing automated memory analysis models and the reliance on expert-driven inspection. The results demonstrate that LLMs can identify more IoCs than state-of-the-art tools, support both expert and non-expert analysts, and improve the reproducibility and reduce the complexity of memory forensics workflows.
LLMs can now automate and explain memory forensics, extracting more malware indicators of compromise than existing tools and making analysis accessible to non-experts.
Memory forensics is an effective methodology for analyzing living-off-the-land malware, including threats that employ evasion, obfuscation, anti-analysis, and steganographic techniques. By capturing volatile system state, memory analysis enables the recovery of transient artifacts such as decrypted payloads, executed commands, credentials, and cryptographic keys that are often inaccessible through static or traditional dynamic analysis. While several automated models have been proposed for malware detection from memory, their outputs typically lack interpretability, and memory analysis still relies heavily on expert-driven inspection of complex tool outputs, such as those produced by Volatility. In this paper, we propose an explainable, AI-assisted memory forensics approach that leverages general-purpose large language models (LLMs) to interpret memory analysis outputs in a human-readable form and to automatically extract meaningful Indicators of Compromise (IoCs), in some circumstances detecting more IoCs than current state-of-the-art tools. We apply the proposed methodology to both Windows and Android malware, comparing full RAM acquisition with target-process memory dumping and highlighting their complementary forensic value. Furthermore, we demonstrate how LLMs can support both expert and non-expert analysts by explaining analysis results, correlating artifacts, and justifying malware classifications. Finally, we show that a human-in-the-loop workflow, assisted by LLMs during kernel-assisted setup and analysis, improves reproducibility and reduces operational complexity, thereby reinforcing the practical applicability of AI-driven memory forensics for modern malware investigations.
