When Benign Is Unverified: Label-Signal Mismatch and Abstention-First Triage in Graph-Based Memory Forensics

When “Benign” Is Unverified: Label–Signal Mismatch and Abstention-First Triage in Graph-Based Memory Forensics Viraj Rajeshbhai Chudasamaa , Eduardo Palmierib , Dipo Dunsina , Aisha Junejob , Mohamed Chahine Ghanemb,c,∗ a Department of Applied Computing, IICL, University of Wales Trinity Saint David, London, E14 4HA, UK b School of Computer Science and Mathematics, Keele University, Newcastle-under-Lyme, ST5 5BG, UK c School of Computer Science and Informatics, University of Liverpool, Liverpool, L69 3BX, UK

arXiv:2611.01225v1 [cs.CR] 31 Oct 2026

Abstract Machine-learning triage for memory forensics is usually validated on corpora whose benign class is asserted by provenance and never verified. We report a validation study of a graph-based triage pipeline for Windows memory images: Volatility 3 output is compiled into typed heterogeneous graphs and scored by a temperature-scaled GINE classifier and two one-class encoders, fused with rule risk under an abstention gate. On MalVol-25 a transparent rule layer contradicts the benign label on every control (15/15 and 18/18 flagged; at least 11 of 15 paired controls rated HIGH or CRITICAL), and mean injection and command-and-control counts run higher on controls than on infected captures. We call this rule–label discordance label–signal mismatch; it shows the benign class is unverified, not compromised. Leave-one-family-out AUROC over matched pairs is provably three-valued, so a reported mean and standard deviation identify the fold composition. The learned model (0.786 ± 0.311; 9/4/1, scored in-sample by a frozen checkpoint) equals a logistic model over rule-derived attributes (0.786 ± 0.410; 11/0/3) in mean only, and its significance rests on dropping four saturated ties. The fusion path sends 97.7% of snapshots to analyst review, 95.3% with every gate disabled. Two public feature-level corpora show the same defect: on CIC-MalMem-2022 every benign row carries injected regions and one host-population feature reaches AUROC 0.997 under leave-one-family-out validation; on the Sihwail et al. (2021) sample the injection indicator fires on 53% of benign rows. We close with seven reporting artefacts for learned triage on corpora whose ground truth is asserted. Keywords: Memory forensics, Forensic tool validation, Triage, Dataset ground truth, Graph neural networks, Selective classification 1. Introduction Digital forensic tools are expected to have known, communicable error rates (Horsman, 2019; Bollé et al., 2020), and the field keeps returning to validated methods and shared, documented corpora as the conditions for progress (Grajeda et al., 2017; Breitinger and Jotterand, 2023). Machine-learning triage fits that expectation poorly. Memory-based malware detectors are routinely reported at or near 99% accuracy on featureengineered corpora whose benign class is balanced by construction (Carrier et al., 2022; Bozkir et al., 2021; Dener et al., 2022). We reproduce that figure on CIC-MalMem-2022 in Section 7, and show what it rests on. Such figures take something for granted that is seldom audited, namely that the label attached to a capture describes the state of the host. In malware corpora the “benign” class is often defined by provenance: a folder name, a snapshot taken before a sample was detonated, a capture that nobody reported. A model can then be right about the data and wrong about the world, and every property an examiner relies ∗ Corresponding author.

Email addresses: 2435000@student.uwtsd.ac.uk (Viraj Rajeshbhai Chudasama), e.a.palmieri@keele.ac.uk (Eduardo Palmieri), d.dunsin@uwtsd.ac.uk (Dipo Dunsin), a.junejo@keele.ac.uk (Aisha Junejo), m.ghanem@keele.ac.uk (Mohamed Chahine Ghanem)

on downstream (calibration, uncertainty, explanation) inherits the defect. Windows memory forensics makes the problem easy to see. A memory image records the volatile state of a live host: processes and their parentage, loaded modules, virtual address descriptors (VADs), handles, threads, drivers and network objects (Ligh et al., 2014; Case and Richard, 2017; Block, 2023; Dehfouli and Habibi Lashkari, 2026). The artefacts are relational, which is the motivation for graph learning over snapshots (Song et al., 2018; Bilot et al., 2024). Even a host that has never been infected leaves, in its memory image, a large volume of indicators of the kind that malware also produces. Security products and other legitimate software install API hooks in volumes that overwhelm manual review (Case et al., 2019). Heuristics of the malfind family flag private executable memory that benign software also allocates, and at the same time miss injected pages hidden from the VAD view (Ligh et al., 2014; Block and Dewald, 2019). Live acquisition is not atomic, and causal inconsistencies have been shown to be the normal condition of a software-acquired memory dump, on Linux and on Windows alike (Pagani et al., 2019; Ottmann et al., 2024; Rzepka et al., 2024, 2025). Run an ordinary triage ruleset over a baseline image that is nominally clean and it will often return a HIGH verdict, the second-highest of the four risk bands

(LOW, MEDIUM, HIGH, CRITICAL) that such rulesets use, and one that would normally justify escalating the host to an examiner. This paper takes that observation as its subject. We build a complete pipeline, from Volatility 3 extraction to an abstention gate, and put it through a validation protocol that asks three questions. RQ1: does the benign class of a paired memory corpus behave like a verified benign class under a transparent, reproducible rule instrument? RQ2: does the learned component add anything to the rules it is built on? RQ3: does the supervision support the claims (calibration, coverage, generalisation) that would normally be made from a learned triage model? On this corpus the answer to RQ1 is no, and the answers to RQ2 and RQ3 are largely no; the negative answers can be measured and reproduced. We then ask whether the finding is peculiar to one corpus, and repeat the audit on two public memory corpora that release Volatility-derived features rather than images. The forensic question behind triage is the first one an examiner asks of a host, “what happened here, and is this machine compromised”; our concern is whether a public forensic dataset can tell us how well a tool answers it. Throughout, a rule-layer verdict is treated as one imperfect witness against another, the provenance label; where the two disagree we say that the benign label is unverified, and we do not infer from the disagreement alone that the host was compromised.

audit is needed because on a matched-pair corpus the customary summary, a mean AUROC over folds, cannot tell a model that orders pairs correctly from one that re-expresses the curation rules or from one that is simply tied, so a published figure can look significant while carrying no evidence of learning. We also separate, for every rung of the ladder, an out-of-sample estimate (a model refitted without the heldout family) from an in-sample diagnostic (a frozen checkpoint that has seen every fold), and report which of the two each number is. 4. We show by gate ablation that near-total abstention survives the removal of every uncertainty gate, quantify the degenerate score field behind it, and project the decisive path to realistic base rates (Sections 6.3–6.5). 5. We distil seven reporting artefacts for learned forensic triage on corpora with asserted ground truth (Section 8). The protocol turns caveats that are usually confined to a limitations section into artefacts that an author must produce and a reviewer can check, and it is what allows the same audit to be run on corpora that release features rather than images. 6. We run the audit on two public feature-level corpora, CICMalMem-2022 and the memory-artefact corpus of Sihwail et al. (2021), and find the benign-class problem in two further forms: a corpus on which a rule layer would flag every benign row while one host-population feature separates the classes under every hold-out, and one on which the injection indicator fires on half of the benign class (Section 7).

Contributions. 1. We formalise label–signal mismatch (mismatch rate, indicator gap and three physical causes) and turn it into a governance schema that records label difficulty per row, in machine-readable form (Section 3). The schema makes the cleanliness of a benign class an auditable property of the corpus rather than an assumption of the paper, and it lets a strict training filter refuse the rows that fail the check.

We claim no detection advance: the pipeline does not detect malware better than the rule layer it is built on, and the paper does not try to make it do so, because a detection claim would require a benign class whose cleanliness has been verified, which Section 6.1 shows this corpus does not provide. Selective accuracy against manifest labels is 0.537 on the 41 decisive snapshots, strict validation AUROC is 0.438, and the fusion path issues no decisive verdict at all. Reporting this with the instrumentation that explains it is of more use to forensic practice than a headline metric obtained by discarding the rows that make the problem hard. The paper therefore distinguishes five things that a single headline metric conflates: the validity of the dataset’s labels, the validity of the forensic instrument that contradicts them, the construct validity of the evaluation design, the validity of the learned model, and the operational usefulness of the triage it produces. Each is reported on its own evidence.

2. We specify an abstention-first architecture: a temperaturescaled GINE classifier and two one-class encoders fused with rule risk under a selective-classification gate, with attribute profiles that separate learned structure from rulederived features (Section 4). The design answers a gap in learned forensic triage, where abstention is rarely reported as a result and learned scores are seldom separable from the rules that curated the training data: the rule layer stays usable on its own, every deferral is logged with the trigger that caused it, and the attribute profiles make it possible to show whether the learned component adds information or merely restates the rules. Only the full profile was trained and scored in this study; the two leakage-controlled profiles are specified here and their evaluation is left as the first experiment for a verified corpus (Section 8).

2. Background and related work

3. We give a construct-validity audit for matched-pair corpora, consisting of a leave-one-family-out (LOFO) ladder, a labelpermutation null and ε-tolerant pair diagnostics with exact intervals. We prove that two-graph folds make AUROC three-valued, so that a published mean and deviation reveal the fold composition, and we work out what a design of fourteen pairs can and cannot detect (Section 6.2). The

This section places the study in four strands of prior work: what memory forensics recovers and why its triage rules are noisy, the literature on forensic datasets and ground truth, learned analysis of memory artefacts, and work on evaluation validity, calibration and abstention. It closes by stating the gaps that the paper addresses. 2

Memory forensics and its validation gap. Volatile memory analysis recovers artefacts that never reach disk, such as injected pages, unlinked process objects and short-lived sockets (Ligh et al., 2014). Case and Richard (2017) argue for scalable and repeatable workflows. The literature also explains why a triage rule can be evadable and noisy at once: injected code can be hidden from VAD-based detection, the approach of malfind and similar tools, which walks the virtual address descriptor tree of each process and flags private regions that are executable, (Block and Dewald, 2019), benign hooks are everywhere (Case et al., 2019), and acquisition is not atomic (Pagani et al., 2019). Ottmann et al. (2024) found some form of inconsistency in almost every second analysable dump of a running Linux system, and Rzepka et al. (2024) find causal inconsistencies to be normal in Windows dumps as well. A causal inconsistency is a pair of structures in one dump that could not have coexisted on the running system, because the acquisition copied them at different moments: for example a doubly linked kernel list whose forward and backward links no longer agree, a thread that refers to a process absent from the process list, or a virtual address descriptor tree that does not match the page tables it describes. Part of what a rule layer flags on a dump may therefore have been produced by the acquisition itself rather than by anything that happened on the host.

fiers over process dumps do similarly well (Bozkir et al., 2021). In their survey of malware detection with graph representation learning, Bilot et al. (2024) conclude that feature design, label quality and evaluation design matter more than the choice of classifier; the memory-analysis survey of Dehfouli and Habibi Lashkari (2026) reviews memory acquisition, the public corpora on which memory-based detectors are evaluated, CICMalMem-2022 and the corpus of Sihwail et al. (2021) among them, and the detection methods built on them; and reviews of AI in digital forensics chart the rapid growth of learned analysis (Dunsin et al., 2024). A different strand of work treats triage as sequential decision-making: Ghanem et al. (2026) plan over Registry and memory-timeline artefacts with a Markov decision process and score the outcome at artefact level against adjudicated ground truth, which is the kind of external adjudication that snapshot-level labels lack. Message passing over graphs reaches the discriminative power of the 1-Weisfeiler–Lehman test under sum aggregation (GIN; Xu et al., 2019); GINE (Hu et al., 2020) adds edge features to the message, which matters when injected_into and belongs_to carry different forensic meaning. Evaluation validity and label quality. Apruzzese et al. (2023) document a persistent discrepancy between machine-learning research and practice in cybersecurity, and the base-rate argument explains why a plausible true-positive rate is of little operational use when the benign class dominates (Axelsson, 2000). Arp et al. (2022) catalogue ten recurrent pitfalls, including label inaccuracy, spurious correlations and inappropriate baselines. Models that re-express their own curation rules are a case of leakage (Kapoor and Narayanan, 2023). Our work belongs to this line but moves the audit from the model to the label.

Forensic datasets and ground truth. A tool whose output is a judgement can only be tested against data whose ground truth is known, and dataset availability and documentation remain the weak point of the field (Grajeda et al., 2017). Recent work asks how datasets should be described, shared and built: Breitinger and Jotterand (2023) propose a taxonomy built on the organisation and the origin of the data, since origin decides whether a dataset can be shared at all, and Göbel et al. (2025) set out principles, characteristics and use cases for data set creation. Outside forensics, Joyce et al. (2023) measured what unverified labels cost: against expert ground truth, antivirus majority voting assigns the correct family to 62.1% of samples, and the AVClass labeller to 46.8%. None of these studies looks at the benign half of a paired memory corpus, which is where our problem lies: whether the controls against which a detector is trained and scored are in fact clean, and what a reported metric means when they are not.

Uncertainty and abstention. Modern networks are systematically miscalibrated (Guo et al., 2017; Silva Filho et al., 2023). Monte-Carlo dropout (Gal and Ghahramani, 2016) and deep ensembles (Lakshminarayanan et al., 2017) provide variancebased proxies for uncertainty, which themselves degrade under shift. One-class deep methods offer a conformity view of “normal” behaviour (Ruff et al., 2021). The reject option has been surveyed by Hendrickx et al. (2024), who separate ambiguity rejection (the input lies near a decision boundary) from novelty rejection (the input lies outside what was seen in training); the two learned paths of Section 4 correspond to these two kinds. What is rarely reported is the abstention rate as a result in its own right. In forensic triage every abstention is examiner time, so it has to be.

Learning over memory artefacts. Static analysis is limited by packing and obfuscation, and dynamic analysis is imperfect in ways of its own, among them sandbox detection and evasion, behaviour that depends on triggers or on time, the incomplete code coverage of a single run and the dependence of the trace on the analysis environment (Or-Meir et al., 2019); memory sits between the two. DeepMem (Song et al., 2018) learns graph neural models over a memory graph to locate kernel objects. Its labels are structural, so ground truth can be verified by construction, which is not true of compromise labels. Feature-engineered detectors report near-perfect accuracy on CIC-MalMem-2022 (Carrier et al., 2022; Dener et al., 2022), whose 58,596 records are split evenly between benign and malicious (Carrier et al., 2022), and vision-based classi-

Gaps addressed by this paper. Read together, these strands leave three gaps. First, the studies that report near-perfect memory-based detection validate against labels asserted by provenance and do not examine the benign class they rely on, and the dataset literature asks how data should be described and shared but not how a benign baseline should be verified. Second, the graph-learning and uncertainty literature supplies architectures, calibration methods and reject options, but evaluates them on corpora whose ground truth is taken as given, 3

so a defect in the labels cannot be told from a defect in the model. Third, the evaluation-validity literature audits models and pipelines for leakage and pitfalls rather than the labels themselves, and treats abstention as a design choice rather than as a measured cost. This paper addresses the three in turn: it defines and measures label–signal mismatch on the benign class (Section 3), it builds an architecture whose learned and rulebased parts can be separated and whose deferrals are logged (Section 4), and it evaluates both with a construct-validity audit and a reporting protocol that treat the abstention rate, the fold composition and the label-quality fields as results (Sections 6.2–8).

apportion. Instrument noise: rules fire on legitimate behaviour such as security-product hooks or just-in-time code (Case et al., 2019; Ligh et al., 2014). Latent contamination: a baseline was never verified clean (y = 0 but z = 1). Acquisition artefacts: a non-atomic capture yields inconsistent structures (Pagani et al., 2019; Rzepka et al., 2024). Mismatch is not classical label noise (Frénay and Verleysen, 2014), which assumes a correct latent label corrupted by an independent process and is handled by robust losses or relabelling. Here the latent state may be genuinely ambiguous. A baseline host whose endpoint agent injects into lsass.exe is not mislabelled as benign, and yet it is not clean in the sense the detector is asked to learn. Formally, if pc (e) is the density of the observable evidence e under R z = c and π = Pr[z = 1], no detector has risk below R∗ = min{πp1 (e), (1 − π)p0 (e)} de. As the two evidence distributions overlap, R∗ → min{π, 1 − π} whatever the capacity of the model, and any metric computed against y measures agreement with provenance, not with compromise.

3. Problem formulation: label–signal mismatch This section defines the quantity the paper measures. It introduces the mismatch rate and the indicator gap, names the three physical causes that can produce them, distinguishes mismatch from classical label noise, and then describes the governance schema that records label difficulty per row and the scope of the claims that the pipeline makes. Let x be a memory snapshot with label y ∈ {0, 1} asserted from provenance (here the capture folder: WithVirus → 1, NoVirus → 0), and let z ∈ {0, 1} be the unobserved compromise state of the host. Three objects are kept apart in what follows. The provenance-assigned label y is observable and is what every public corpus supplies. The host state z is latent; it becomes observable only through an independent verification step (a rebuild from known-good media, an allow-list check of every loaded image, an adjudicated manual examination), and no corpus used in this paper records one. The rule verdict r(x) is observable, reproducible by hand from plugin output, and itself unvalidated: its error rates against z are not known. Everything the paper measures on the benign class is therefore a relation between y and r(x), two observables, and not a measurement of z.

Governance schema. We therefore record label difficulty in the dataset manifest and not in the discussion section. Each row carries four fields: benign_subtype ∈ {clean_benign, hard_benign_admin_tooling, ambiguous_novirus_ control}; label_quality_flag, set when the rule layer contradicts y under a fixed predicate on r(x) and ϕ(x) that is stated with the results (Section 6.1); label_quality_reason, the contradicting indicators; and train_eligible, whether the row may enter strict training. The pipeline writes the fields, the manifest versions them, and the training filters read them. An unfalsifiable claim (“our benign set is clean”) becomes one that can be audited, and a reader can reconstruct which rows supported which number. Two consequences of the schema are easily conflated and are kept apart here. A row with train_ eligible=False is unsuitable for strict benign training because an instrument contradicts its label; that is a statement about the evidence available for the row. It is not a statement that the host was compromised, and the schema has no field that would record one, because no rule-layer output can establish it.

Definition 1 (Label–signal mismatch). Let D = {(xi , yi )} be a corpus with Dc = {xi : yi = c}, let r(x) ∈ V = {low ≺ medium ≺ high ≺ critical} be the verdict of a transparent rule layer and ϕ(x) ∈ RK the indicators on which it rests. The mismatch rate and the indicator gap are

Extension for verified baselines. The four fields record what a pipeline can observe. They cannot record what only the corpus builder knows, and a benign class is verified, rather than asserted, only when those fields exist. We therefore propose, and do not claim to have populated, the following per-row extension for paired memory corpora: label_ origin (folder, descriptor, analyst), host_id and capture_ id (so that pairs and repeated captures can be grouped), acquisition (tool, version, guest paused or live, uptime at capture), resident_security_tools, known_good_ attribution (share of loaded images and of executable private regions attributed to allow-listed hashes), verified_ state ∈ {clean, compromised, disputed, unverified} with verification_method and the evidence that supports a clean status, rule_label_discordance (the present flag and reason), and adjudication (reviewer, date, decision). The field verified_state is the only one that speaks to z,

|{x ∈ D0 : r(x) ⪰ high}| , |D0 | δk = ϕ̄k (D1 ) − ϕ̄k (D0 )

µ(D) =

D exhibits label–signal mismatch when µ is large; indicator k is inverted when the rules treat it as monotone in risk yet δk < 0. The mismatch rate is a rate of rule–label discordance: µ = Pr[r(x) ⪰ high | y = 0] estimated on D0 . It is not a contamination rate Pr[z = 1 | y = 0], and the paper never reads it as one. A large µ states that the benign class, as labelled, cannot be distinguished from the malicious class by the indicators a practitioner would cite to justify escalation, and therefore that the label “benign” is unverified with respect to exactly those indicators. It has three physical causes, which a label alone cannot 4

Table 1: Memory-snapshot graph schema. Structural relations are read directly from plugin output; intent relations are asserted by the rule layer and are therefore the locus of the leakage risk discussed in Section 4. Node types

process, thread, dll, memory_region, network_conn, ip_ address, handle, driver, kernel

Structural edges

spawned_by, belongs_to, loaded_into, allocated_in, connects_from, connects_to

Intent edges

injected_into, intent_injection, intent_c2, lolbin_ execution_chain, persistence and credential-access relations

Attribute profiles

full · no_manifest_leakage (rule-derived manifest fields masked) · structure_only (scale, edge distribution, motif tails)

Memory image x

Volatility 3 14 plugin CSVs

Typed heterogeneous graph G

Rule triage r(x), h(x), a(G)

Manifest + governance fields Track B calibrated GINE, pb

Track D dual one-class, m, b

Fusion s(x) + abstention gate g(x) Triage state + structured evidence → examiner

and it is filled by a verification step, never by the rule layer. Section 8 says what each verification step costs and what it excludes.

Figure 1: Pipeline. Extraction and rule-based triage (grey) remain valid independently of the learned components (red); the governance manifest (blue) mediates every training and inference decision and is the artefact that makes label difficulty auditable.

Scope of claims. The pipeline claims provenance traceability (every score resolves to a graph, plugin rows and a rule verdict), governance transparency, recorded deferral (the system may decline to decide, and logs why) and falsifiable evaluation. It claims nothing about detection performance relative to production endpoint tooling, about generalisation to unseen families, or about robustness to an adaptive adversary (Jin et al., 2021); the threat model is explicitly non-adaptive. Under this model the adversary is a malware sample that executes on the guest and leaves whatever artefacts its execution leaves; it is not assumed to know the rule layer, the graph schema or the learned models, and it does not alter its behaviour to evade them. Hiding injected code from VAD-based indicators (Block and Dewald, 2019), poisoning the training corpus and perturbing the graph (Jin et al., 2021) are therefore outside the evaluation, which is one reason the results are reported as a validation of the corpus rather than of a detector. Every deferral is work passed to an examiner. A system that defers often is expensive, not safe, and we report the deferral rate as a cost.

bound on the framework release: windows.threads was introduced in Volatility 3 release 2.8.0 (October 2024), and in the current releases malfind is the deprecated alias of windows.malware.malfind. The release used by the pipeline, together with the symbol-table (ISF) source for each guest, is recorded in the released configuration. Missing output sets a health flag instead of failing silently, so an incomplete sample cannot enter training unnoticed. Three flags are written per sample and gate every later stage: filter_ok (all fourteen plugins returned parseable output), graph_ok (the graph compiled with at least one process node and every referenced identifier resolved) and analyze_ok (rule triage and model scoring completed). Every row reported in this paper carries all three (Section 5). The flags test that output was produced and could be parsed; they do not test that the output is correct. A plugin that silently misses an artefact, as malfind does for injected pages hidden from the VAD view (Block and Dewald, 2019), passes filter_ok. Parseable output and validated output are different things, and the pipeline certifies only the first.

4. Pipeline and models

Graph construction. CSV rows are compiled into a typed heterogeneous graph G = (V, E, τ, ρ, X) with node-type map τ, edge-type map ρ and node features X (Table 1), loaded through PyTorch Geometric. Edges divide into structural relations E s , read from plugin output and reflecting Windows object relationships, and intent relations Ei , asserted by the rule layer and aligned with documented techniques such as Process Injection (T1055) and Data Encrypted for Impact (T1486).1

This section describes the pipeline stage by stage: the extraction of plugin output from a memory image, its compilation into a typed graph, the fixed rule layer, the two learned tracks (a calibrated binary classifier and a pair of one-class conformity encoders), the fusion of their scores with rule risk, and the abstention gate that decides whether a snapshot receives a verdict or is routed to an examiner. Figure 1 shows the flow and Algorithm 1 the logic applied to one snapshot. Each stage writes an artefact that can be inspected, so an examiner who distrusts a model score can fall back on the triage JSON or on the originating plugin row without retraining anything.

From plugin rows to graph elements. Each plugin row becomes one node or one edge, and every node keeps the identifiers of its source row (plugin, process identifier, offset), which is what lets a score be traced back to the output it came from. Process nodes are read from pslist and psscan, with parentage from pstree written as spawned_by; a process present in psscan but absent from pslist is retained as a process node

Extraction. Fourteen Volatility 3 plugins run per sample (pslist, psscan, pstree, malfind, netscan, cmdline, dlllist, handles, threads, vadinfo, filescan, driverscan, ssdt, registry.hivelist, named here without their windows. prefix; Volatility Foundation, 2026) and write per-sample CSVs. The plugin set fixes a lower

1 MITRE ATT&CK enterprise matrix, https://attack.mitre.org/ matrices/enterprise/, accessed 28 May 2026.

5

and marked hidden. Threads, handles and loaded modules become thread, handle and dll nodes joined to their owning process by belongs_to or loaded_into. Each vadinfo region and each malfind hit becomes a memory_region node joined by allocated_in and carrying the RWX, MZ-header, private-memory and commit-charge flags as features. netscan rows become network_conn nodes with connects_from to the owning process and connects_to an ip_address node shared across connections; driverscan and ssdt rows populate the driver nodes and the single kernel node; cmdline, filescan and registry.hivelist contribute node features and rule inputs rather than nodes. Intent edges are added afterwards by the rule layer from these features: injected_ into from malfind regions, intent_c2 from connections that the rules class as command-and-control style, lolbin_ execution_chain from parent–child pairs of living-off-theland binaries, and the persistence and credential-access relations in the same way. Because every intent edge is derived from features that already sit on the nodes, the structure_ only profile of Table 1 removes the intent edges together with the rule-derived attributes.

used by the fusion layer is that maximum score rescaled to the unit interval, and the graph-level attributes a(G) carry the same counts in aggregate; Table 2 reports three of them. The layer is deliberately simple. Its verdicts can be reproduced by hand from the plugin output, which is what qualifies it as a witness against the labels in Definition 1; its own error characteristics are not assumed to be known. Track B: calibrated binary path. With h(0) = Xv , each of L v GINE layers computes
(ℓ) (1 + ϵ (ℓ) ) h(ℓ−1) + m(ℓ) h(ℓ) v v , v = MLP X
m(ℓ) ReLU h(ℓ−1) + eρ(u,v) , v = u

(1)

u∈N(v)

where eρ(u,v) is a vector encoding of the edge type (Hu et al., 2020). The graph representation concatenates mean, max and sum readouts of {h(L) v } with a(G) and feeds a classification head that produces logits z(x). Sum aggregation keeps the layer injective on neighbour multisets (Xu et al., 2019), but on graphs where one node type dominates, the readout is dominated as well; this is what the suspect-mask pooling ablation of Sec
tion 6.2 probes. One forward pass costs O L (|V| + |E|) d for hidden width d, so even the largest graph in the corpus (27,362 nodes, 39,117 edges) is cheap next to the Volatility run that produces it. Training uses class-weighted loss and early stopping on a held-out fold, followed by temperature scaling (Guo et al., 2017):
pb (x) = softmax z(x)/T 1 , (2) T = arg minT ′ >0 NLLval (T ′ ).

Features and leakage control. Node features combine type encodings with forensic indicators (RWX and MZ-header flags, private memory, commit charge, load counts, per-node edgerole counts). Graph-level attributes a(G) summarise scale, density, injection and C2 counts, attack-step and persistence counts, and motif tails. Many of these come from the rule layer, and that creates an obvious circularity: a model fed r(x)-derived attributes and evaluated on a corpus curated with r(x) can appear to learn while merely restating the rules. We therefore define three attribute profiles, which receive the following inputs: full (all node features, all structural and intent edges, and the complete a(G)); no_manifest_leakage, which masks rulederived manifest fields (maximum score, attack steps, injection and C2 counts, triage and subtype flags) from a(G) but keeps the node features and the intent edges; and structure_only (structural edges only, node features reduced to type encodings and the plugin-level counts that no rule interprets, and a(G) reduced to scale, density and degree-distribution summaries). The per-node edge-role counts and the memory_region nodes derived from malfind are themselves instrument output, so even structure_only is free of rule-layer scoring but not of heuristic extraction. Every learned result in Sections 6.2–6.5 was produced under the full profile; the other two profiles were specified but not trained or scored in this study, and the leakage argument of Section 6.2 rests on a comparison with a rule-attribute baseline rather than on a profile ablation.

Because z 7→ z/T is monotone, T changes confidence but not ranking. AUROC does not depend on it, and calibration therefore cannot repair a ranking defect. The classifier is trained by minimising a class-weighted cross-entropy and stopped early on the held-out fold; the strict split of Section 5 reserves 8 of the 43 snapshots for that purpose. The temperature is then fitted by a bounded one-dimensional search on the validation negative log-likelihood whose upper limit is 20. Two variance estimates accompany every probability. The Monte-Carlo dropout variance VarMC [pb ] is the variance of pb over repeated forward passes with dropout kept active at inference (Gal and Ghahramani, 2016); the ensemble variance Varens [pb ] is the variance of pb across independently seeded training runs of the same architecture (Lakshminarayanan et al., 2017). Both are compared with fixed thresholds θv and θe in the abstention gate, and pb counts as saturated when it lies within a fixed margin of 0 or 1. The number of layers L, the hidden width d, the dropout rate, the number of stochastic passes, the ensemble size, the optimiser settings and the gate thresholds are fixed before evaluation and recorded in the released configuration. The eight validation graphs of the strict split serve both early stopping and the temperature fit, so the calibration figures reported on them in Section 6.3 are not held out with respect to T . The analysis stage does not threshold at 0.5. It assigns four bands using pb and a narrow ambiguity interval [τlow , τhigh ]: ‘likely benign’, ‘low-risk ambiguous’, ‘high-risk ambiguous’ and ‘likely mali-

Rule triage. The rule layer is a fixed, human-readable scoring of the graph that runs before, and independently of, any learned component. Each process accumulates points from the indicators attached to it and to its regions, connections and children (injected regions, hidden status, C2-style connections, livingoff-the-land chains, persistence and credential-access hits), and the snapshot verdict r(x) is the band of the maximum process score, from low to critical. The heuristic risk h(x) ∈ [0, 1] 6

Algorithm 1 Abstention-first triage of one memory image Input: memory image x; gate preset π; fusion weights (wb , wd , wh ); triage band [τ1 , τ2 ) = [0.40, 0.65); gate thresholds θv , θe , θ∆ Output: triage state q, fused score s, trigger set T , evidence pointers 1: Run the fourteen Volatility 3 plugins on x, compile the typed graph G and set the health flags 2: Apply the rule layer to G to obtain the verdict r, the heuristic risk h and the graph attributes a 3: Write the governance fields of Section 3 to the manifest
4: pb ← softmax fθ (G, a)/T 1 ▷ Track B, Eq. (2) 5: m ← fmal (G), b ← fben (G), ∆ ← m − b ▷ Track D 6: s ← wb pb + wd d(m, b) + wh h ▷ Eq. (3) 7: if s ≥ τ2 then 8: q ← ‘likely malicious’ 9: else if s < τ1 then 10: q ← ‘likely benign’ 11: else 12: q ← ‘needs analyst review’ ▷ or ‘anomalous unknown’, see

cious’, where the two ambiguous states are separated by heuristic risk h(x) and not by pb . Track D: dual conformity path. Two one-class GINE encoders are trained separately (Ruff et al., 2021): a malware-pattern model yielding m(x) ∈ [0, 1] and a benign-conformity model yielding b(x) ∈ [0, 1], with margin ∆(x) = m(x) − b(x). Each encoder has the layer structure of Eq. (1) followed by a graph readout, and is trained on the snapshots of its own class only under a one-class objective that draws the embeddings of that class towards a common centre (Ruff et al., 2021). At inference the distance of a snapshot’s embedding to the centre is mapped monotonically to the unit interval, so that m(x) is high when the snapshot resembles the malware-labelled training graphs and b(x) is high when it resembles the benignlabelled ones; writing δc (x) for the distance to the centre of class c, the map is m(x) = ψ(δmal (x)) and b(x) = ψ(δben (x)) with ψ : [0, ∞) → [0, 1] decreasing and fixed before evaluation. The dual signal d(m, b) ∈ [0, 1] is a fixed function of the margin ∆ = m − b, increasing in ∆, and all three terms of the fusion below lie in [0, 1] and are oriented so that larger values mean greater risk; since the weights sum to one, s(x) ∈ [0, 1]. A fusion layer forms the convex combination
s(x) = wb pb (x) + wd d m(x), b(x) + wh h(x), (3)

text 13: end if 14: T ← ∅ 15: if VarMC [pb ] > θv then add dropout variance to T 16: end if 17: if Varens [pb ] > θe then add ensemble variance to T 18: end if

with (wb , wd , wh ) = (0.35, 0.40, 0.25), where d is the dualmodel signal, thresholded into triage states at (0.40, 0.65). The intention is that a snapshot may be suspicious without being recognised: ‘anomalous unknown’ is a legitimate output, distinct from both classes, and is assigned before any gate when neither encoder recognises the snapshot, that is when m(x) and b(x) both fall below a fixed floor.

19: if |∆| < θ∆ then add low margin to T 20: end if 21: if pb and (m, b) disagree and pb is not saturated then add

disagreement to T 22: end if 23: if the gate of preset π fires on T then 24: q ← ‘needs analyst review’; log T 25: end if 26: return q, s, T and pointers to G, the plugin rows and the

Abstention gate. An uncertainty gate can override any decisive state with ‘needs analyst review’ and records the trigger: high Monte-Carlo dropout variance (Gal and Ghahramani, 2016), high ensemble variance (Lakshminarayanan et al., 2017), low dual margin, or binary–dual disagreement. The last is suppressed when pb is saturated, since an overconfident head is not evidence of uncertainty. Three presets make the routing behaviour itself something that can be ablated (Section 6.5): disabled applies no gate, so a snapshot is routed by the fused score alone; legacy_or fires on any of the four triggers, including disagreement whether or not pb is saturated; and calibrated, the preset behind every routing result reported here, applies the trigger set T of Algorithm 1 as written, with the saturation exception. In selective-classification terms (Hendrickx et al., 2024), the gate is a selection function g(x) = 1[q(x) decisive] with coverage φ = E[g(x)] and selective risk R = E[ℓ(ŷ, y) g(x)]/φ. A reject rule based on the posterior is optimal only when the posterior can be trusted. Where it cannot, the honest summary of an abstaining system is the pair (φ, R) together with an ablation showing what produces φ.

rule hits

step by step, and the metrics and derived statistics reported in Sections 6.1–6.5. Corpora. Samples derive from MalVol-25, a public Windows volatile-memory dataset of paired clean and infected virtual-machine snapshots (Dunsin et al., 2025a,b). We use two manifest views over the same artefact contracts. The descriptive corpus (n=30) comprises fifteen families, each contributing one infected capture and one control from the same host configuration: ten ransomware families (Cerber, DeriaLock, Dharma, GandCrab, GoldenEye, InfinityCrypt, Locky.AZ, LuckyLocker, Spora, WannaCry), two worms (MyDoom, BlackWorm), PowerLoader, RedTail (a cryptominer) and a DLL-hijacking scenario, categorised as in the dataset descriptor, across Windows 7, 8.1, 10 and 11 guests. The ML corpus (n=43; 25 malware-labelled, 18 benign-labelled) retains the paired rows, adds further captures from the same lineage, and is the authoritative source for all learned results. All re-

5. Experimental setup This section describes the corpus and its two manifest views, the grouping and splitting protocol, the construct-validity audit 7

ported rows passed the filter_ok, graph_ok and analyze_ ok health checks. The descriptor states that each clean snapshot was taken from the guest in its uninfected state and validated by Volatility extraction and manual inspection. It records no independent check that baselines are free of injection-like activity. That is typical of the field and not a peculiarity of this dataset, and it is the reason we write benign-labelled throughout. The descriptor reports clear differences between clean and infected states under manual comparison; our question is whether those differences survive translation into the thresholded indicators that automated triage depends on. The descriptor does not state the acquisition tool, whether the guest was paused or running when its memory was read, or the uptime at capture, so the acquisition-artefact cause of Section 3 can be neither confirmed nor excluded for any row. Two further public corpora, used for external validation of the protocol rather than of the pipeline, are described in Section 7.1.

null that should replace it. (iii) The paired diagnostics of Table 5 use the same 14 folds and the within-pair score difference ∆P f with tolerance ε=0.05. (iv) The suspect-mask ablation repeats step (i) with the readout restricted to nodes that carry at least one rule hit. (v) Because the GNN’s ties are produced by saturation rather than by chance, every sign test on a rung with ties is reported twice, with ties dropped (the conventional test) and with ties counted as losses (a tie is a failure to order the pair); the two agree when T =0. Every threshold that enters a reported number is fixed: the ambiguity interval [0.632, 0.712] of Track B, the fusion weights (0.35, 0.40, 0.25) and triage band [0.40, 0.65), the tolerance ε, B, and the strict split of 35 training and 8 validation snapshots. No threshold was tuned on a test fold; the temperature of Track B is the one quantity fitted on held-out data, and the eight graphs it was fitted on are also the eight on which its calibration is reported (Section 6.3). Metrics and derived statistics. We report AUROC, the probability that a positive outranks a negative with ties counted one half, together with the fold standard deviation; precision, recall, F1 and selective accuracy on decisive predictions (the overall accuracy that counts an abstention as an error is given alongside it); Brier score, expected calibration error (ECE; Guo et al., 2017; Silva Filho et al., 2023) and fitted temperature; and, as results in their own right, review-routing rate, decisive coverage and gate-trigger counts. Every proportion carries an exact 95% Clopper–Pearson interval (Clopper and Pearson, 1934), paired comparisons use exact one-sided sign tests with ties dropped, and the Monte-Carlo error of the permutation p-value is stated (Ojala and Garriga, 2010). The Brier score is the mean squared difference between pb and the manifest label; ECE partitions [0, 1] into equal-width bins and sums, over bins, the bin’s share of samples times the absolute gap between its mean probability and its empirical accuracy; the Clopper–Pearson interval for k successes in n trials is the exact binomial interval whose end points are the α/2 quantile of Beta(k, n−k+1) and the 1−α/2 quantile of Beta(k+1, n−k); the one-sided sign test on W wins and L losses reports Pr[X ≥ W] for X ∼ Bin(W + L, 12 ); and pooled AUROC comparisons use the exact one-sided Mann–Whitney test. These derived quantities are computed from the counts and per-sample values reported here by a script that accompanies the artefacts. All primary numbers come from the archived analysis files and the construct-validity report. The derived-statistics and externalaudit scripts were drafted with the assistance of a generative-AI coding tool and were reviewed, run and checked by the authors; every number they produce is reproducible from the archived files.

Protocol. Both members of a family pair share a host baseline, so random splitting leaks badly. Family is the grouping key throughout, and the construct-validity audit uses strict LOFO over the 14 complete pairs of the ML corpus. This is a matched instance of leave-pair-out cross-validation, the preferred AUROC estimator on small samples (Airola et al., 2011). Tabular and graph-attribute rungs refit a logistic model per fold, so their LOFO values are out-of-sample estimates. GNN rungs score a frozen checkpoint with softmax P(malware) at T =1 and no perfold refit. Their LOFO values are therefore in-sample ranking diagnostics of a checkpoint that has seen every fold, and we report them as such; they are not out-of-sample performance estimates, and we no longer describe them as upper bounds, since a model trained on a fold is expected but not guaranteed to rank it at least as well as one that was not. The label-permutation null uses B=500 permutations, applied to the same frozen checkpoint without retraining, so it tests whether the checkpoint’s fixed ordering is associated with the labels and not whether a model trained under the null would reach the observed mean. Because no benign-labelled row is train-eligible (Section 6.1), a strict trainer has no benign class to fit. Both learned paths were necessarily fitted with the flagged controls standing in for that class, and every learned result inherits this caveat: the benign one-class encoder of Track D is, in effect, a contaminatedcontrol experiment, and Section 6.4 reads it as one. The construct-validity audit in full. The audit runs as follows. (i) For each of the F=14 complete family pairs the pair is held out and the rung under test is scored on its two graphs; tabular rungs are refitted on the remaining 41 snapshots, GNN rungs use the frozen checkpoint. The fold AUROC A f takes the value 1, 21 or 0 (Proposition 1), and the ladder reports the fold mean, the population standard deviation across folds and the composition (W, T, L). (ii) The label-permutation null relabels the 43 snapshots at random B=500 times, repeats step (i) for the GNN rung, and reports the fraction of permuted means at or abovepthe observed mean as p, with Monte-Carlo standard error p(1 − p)/B; Section 6.2 shows that this permutation was not confined to pairs and gives the exact within-pair

6. Results Results are reported in the order of the audit. Section 6.1 examines the benign class itself, Section 6.2 asks whether the learned model adds anything to the rules, Sections 6.3 and 6.4 report the calibrated and the conformity path, and Section 6.5 ablates the abstention gate. 8

Table 3: Four family pairs from the descriptive corpus. In every pair the control carries indicators that would justify escalation on its own; in two of the four it is not clearly quieter than its infected partner.

Table 2: Governance audit and indicator gaps. Every benign-labelled row in both views is flagged and none qualifies as clean_benign; two of three headline indicators are inverted (Definition 1). The descriptive view records the flag and the ML view the eligibility field; a dash marks a field the view does not record.

Descriptive ML (n=30) (n=43) Malware- / benign-labelled rows ambiguous_novirus_control label_quality_flag set train_eligible=False clean_benign

15 / 15 15/15 15/15 — 0

25 / 18 18/18 — 18/18 0

Descriptive corpus

Benign Malware Gap δk

Injections (mean) C2-style connections (mean) Max. process score (mean) Nodes (median) Edges (median)

11.73 13.20 76.60 17,595 25,684

10.93 11.27 79.80 20,077 25,635

Family

Capture Nodes Inj. Verdict

GoldenEye

infected control

n/r n/r

Cerber

infected control

7,904 9,382

6 HIGH 6 HIGH

WannaCry

infected control

8,098 7,590

7 HIGH 9 HIGH

MyDoom

infected control

164 86

0 LOW 0 LOW

41 CRITICAL 8 CRITICAL

Every control row is tagged ambiguous_novirus_control with label_ quality_flag=True. The descriptive manifest records C2-style connections for the Cerber pair only (24 infected, 7 control) and no node counts for the

−0.80 −1.93 +3.20

GoldenEye pair (n/r); GoldenEye’s control additionally reports 13 hidden processes.

Table 4: LOFO stage ladder over the 14 complete family pairs. W/T/L is the fold composition implied by Proposition 1; sign-test p-values are exact, onesided, with ties dropped. The two logistic rungs are refitted per fold (out-ofsample); the two GNN rungs score a frozen checkpoint trained on every fold (in-sample diagnostics).

6.1. The benign class does not behave like a verified benign class Table 2 states the central finding. In neither manifest view does a single benign-labelled snapshot survive as a verified baseline. All 15 descriptive and all 18 ML benign rows are tagged ambiguous_novirus_control (exact 95% lower bounds on the flagged share: 0.78 and 0.82), and on the ML corpus none is train-eligible under the strict filter. The recorded reasons are ordinary forensic ones: HIGH or CRITICAL verdicts, elevated maximum process scores, non-zero injection counts, C2-style connections. The flag is set when any one of these recorded reasons is present, so the flag rate (15/15) and the mismatch rate µ, which counts verdicts of HIGH or above only, are different quantities and are reported separately below. It is the size of the effect that surprised us. On the descriptive corpus the rule layer returns HIGH or above on 25 of 30 samples, MEDIUM on 3 and LOW on 2. Both LOW rows belong to one pair, so at least 11 of the 15 controls are rated HIGH or CRITICAL and µ ≥ 0.73; the three MEDIUM verdicts bound it from above at 14/15. The class-conditional means run the wrong way for two of the three headline indicators. Benignlabelled rows average 11.73 injections and 13.20 C2-style connections, against 10.93 and 11.27 for malware-labelled rows, and only maximum process score is marginally higher on the malicious side (79.80 vs 76.60). A practitioner escalating on injection or C2 volume alone would escalate the controls slightly more often than the infected captures. Graph scale does not separate the classes either: node counts run from 86 to 27,362 and edge counts from 7 to 39,117, both extremes are occupied by both classes, and the medians differ by 2,482 nodes (17,595 against 20,077) and by 49 edges (25,684 against 25,635) (Table 2). Individual pairs make the mechanism concrete (Table 3). GoldenEye’s infected capture records the corpus maximum of 41 injections, but its own control records 8 injections, 13 hid-

Stage

AUROC SD W/T/L Sign p Null p

Manifest tabular (LR) Graph attributes (LR) GNN, global pooling† GNN, suspect-mask†

0.643 0.786 0.786 0.786

0.479 9/0/5 0.212 — 0.410 11/0/3 0.029 — 0.311 9/4/1 0.011‡ 0.044 0.311 9/4/1 0.011‡ —

Pooled AUROC, frozen checkpoint, all 43 snapshots Global 0.615 Suspect-mask 0.615 ∆ LOFO (mask − global) 0.000 † frozen checkpoint, in-sample; across-pair permutation null ‡ ties dropped; p = 0.212 with the four ties counted as losses

den processes and a CRITICAL verdict. Cerber’s pair is comparable in scale (7,904 vs 9,382 nodes); both members carry six injections and HIGH verdicts and differ mainly in C2 count (24 vs 7). WannaCry’s control reports more injections than its infected counterpart (9 vs 7). Only the MyDoom pair, at 86 and 164 nodes far smaller than the rest, returns LOW on both members, and even there the control is flagged. 6.2. Construct validity: does the model add anything? Table 4 is the most useful diagnostic in the paper. Read downwards it is encouraging: adding graph attributes lifts LOFO AUROC from 0.643 to 0.786, and the learned model is separable from a label-permutation null at p=0.044 (observed 0.786 against 0.498 ± 0.161). Read across, it deflates. The graph neural network matches, to three decimal places, a logistic regression over rule-derived graph attributes, and restricting pooling to suspect-flagged nodes changes nothing (∆=0.000; identical pooled AUROC of 0.615). Read with the footnote, it 9

deflates further. The two logistic rungs are out-of-sample estimates; the two GNN rows are in-sample diagnostics of a checkpoint that had seen both graphs of every fold. A checkpoint that has seen a pair and still cannot order it by more than a rounding margin is informative about the representation, not about generalisation, and nothing in Table 4 is evidence that the network would reach 0.786 on a family it had not seen. The standard deviations carry more information than is usually taken from them.

Table 5: Paired-control diagnostics over 14 family pairs with tolerance ε=0.05, where ∆P f = PWV − PNV is the within-pair score difference of the frozen GNN checkpoint (in-sample). Intervals are exact 95% Clopper–Pearson.

Diagnostic

W = F Ā − T2 ,

95% CI

Pair-rank accuracy (∆P f ≥ ε) 0.286 4/14 0.08–0.58 Pair inversion rate (∆P f ≤ −ε) 0.000 0/14 0.00–0.23 Near-tie rate (|∆P f | < ε) 0.714 10/14 0.42–0.92 Zone suspect-count inversion Zone max-score inversion

Proposition 1 (Two-graph folds). Let each of F folds hold one positive and one negative graph with scores s+f , s−f . Then the fold AUROC is A f = 1[s+f > s−f ] + 12 1[s+f = s−f ] ∈ {0, 21 , 1}. If W, T and L folds take the values 1, 12 and 0, the fold mean Ā and population variance σ2 satisfy
T = 4F Ā − Ā2 − σ2 ,

Value Pairs

0.429 0.571

6/14 0.18–0.71 8/14 0.29–0.82

What fourteen pairs can detect. Proposition 1 also fixes the resolution of the design. With F=14 untied pairs, a one-sided sign test at α=0.05 needs at least 11 wins, that is a LOFO mean of at least 11/14 = 0.786. The headline value of both models is therefore the smallest mean that a fully decided design of fourteen pairs can declare significant, and the step from 0.643 to 0.786 is two pairs. The qualification matters: when ties are dropped, a rung with many ties can be declared significant at a lower mean (seven wins and seven ties give Ā = 0.750 and p=0.008), which is a further reason to report the composition and not the mean alone. Power is correspondingly low. If a model truly ordered 75% of matched pairs correctly, fourteen pairs would detect it with probability 0.52; 80% power at that effect needs 28 pairs, and 42 if the true rate is 70% (the exact test’s power is not monotone in F because the critical count moves in steps: 23 pairs first reach 0.80 at a true rate of 75% but 24 and 25 fall below it, and 28 is the smallest F from which power stays at or above 0.80; the same convention gives 42 at 70%, where 37 pairs first reach it). A paired corpus meant to support claims about learned triage should be sized from such a calculation, not from the number of malware families that happen to be available.

L = F − W − T, (4)

so (Ā, σ) determine (W, T, L) uniquely. Proof. Ā = (W + T/2)/F and E[A2 ] = (W + T/4)/F, hence σ2 = Ā − T/(4F) − Ā2 ; solve for T , then W and L. Two things follow. First, Ā over matched two-graph folds is simply the fraction of pairs ordered correctly, with ties counted one half. It sees only within-pair order, and “0.786 ± 0.311” summarises fourteen ternary outcomes, not a smooth performance estimate. Second, Eq. (4) recovers the composition from the published summary (Table 4; Figure 2c). For the GNN row, T = 56 (0.786 − 0.7862 − 0.3112 ) = 4.0, hence W = 11 − 2 = 9 and L = 1. The reconstruction tolerates the rounding: for F=14 the 120 possible compositions remain distinct after Ā and σ are rounded to three decimals, the nearest two compositions that share a mean differ in σ by 0.037, and a non-integer T from Eq. (4) is the sign that a reported deviation is a sample rather than a population one (for the GNN row the sample deviation would be 0.323). The two 0.786 rows turn out to be different objects. The attribute-only regression is decisive in every fold and right in 11 of 14 (sign test p=0.029). The GNN is right in 9, wrong in 1 and exactly tied in 4 (p=0.011 on ten untied folds). Exact ties are what saturated outputs produce: the fitted temperature of Section 6.3 implies logits an order of magnitude too large, so at T =1 both members of a pair can round to the same probability. A saturated tie is not a chance event that the sign test may discard; it is a failure to order the pair. Counted as losses, the four ties give 9 wins against 5 non-wins and p=0.212, the same value as the manifest-tabular rung. The significance of the GNN row therefore rests entirely on the convention of dropping ties, and we report both values. The manifesttabular rung (9/0/5; p=0.21) cannot be told from guessing. The permutation result is fragile as well. With B=500 the MonteCarlo standard error of p=0.044 is 0.009, and its 95% interval [0.026, 0.062] straddles 0.05; and because the checkpoint was scored, not retrained, under each permutation, the p-value tests the association between a fixed in-sample ordering and the labels, which is the weakest claim a permutation test can support.

Corollary 1 (Exact within-pair null). If labels are exchangeable within each pair, then Ā = (X + T/2)/F with X ∼ Bin(F − T, 12 ), the exact p-value is Pr[X ≥ W], and the null √ √ standard deviation of Ā is F − T /(2F) ≤ 1/(2 F). The null has only 214 = 16,384 configurations, so it can be enumerated and the Monte-Carlo error above is avoidable; its p-values are the sign-test values of Table 4. For F=14 the bound equals 0.134, whereas the reported permutation null has a standard deviation of 0.161. Since 0.161 exceeds a bound that holds for every within-pair null, the reported null was not a within-pair one: labels were permuted across pairs, which breaks the matching and lets between-family variance back in (under a permutation of all 43 labels a fold keeps one graph of each class with probability 0.498 only, so half the folds of a permuted replicate have no defined AUROC). The within-pair values are the ones to quote, with the proviso of the previous paragraph: for a frozen checkpoint they remain in-sample, and the test that would support a generalisation claim, refitting the network without the held-out family and enumerating the withinpair null on the refitted scores, was not run in this study. Table 5 asks the question an examiner actually asks (given 10

Mann–Whitney p=0.20), in line with the 0.615 of the constructvalidity checkpoint. Neither can be distinguished from chance at this sample size. Two calibration artefacts deserve comment. First, strict-split validation AUROC is 0.438, below chance on eight validation graphs, while best validation F1 is 0.667. On a fold this small the two numbers are uninformative, not contradictory, and quoting either as a headline would mislead. Second, the fitted temperature is 20.00, which coincides with the upper limit of the search range. The optimum was not bracketed, so 20.00 is a lower bound on the temperature that minimises validation NLL, and the reported calibration is the least softening the search allowed; T is reported as a search bound, not as a fitted optimum. Combined with a calibrated ECE of 0.505, a binned estimate computed from eight validation graphs (Silva Filho et al., 2023), which were also the graphs on which T was fitted, so the estimate is optimistic as well as unstable, this shows a probability field that carries no usable confidence information. The Brier score of 0.496 says the same thing more bluntly. A constant prediction of 0.5 scores 0.25 whatever the labels, so on the validation fold the calibrated probabilities do worse than saying nothing. We report these figures as a diagnostic of failure and not as a calibration result, and we describe the probability field as diagnostically miscalibrated rather than as calibrated or uncalibrated: eight graphs cannot establish either. A calibration claim on this corpus would need the temperature fitted and evaluated on disjoint folds under nested leave-one-family-out validation, with an interval on the ECE; none of this is possible with 43 snapshots and a single 8-graph split.

Table 6: Track B on the ML corpus (n=43). Calibrated probability separates the triage bands cleanly; agreement with manifest labels does not follow.

Triage state

n Min Median Max

likely benign high-risk ambiguous low-risk ambiguous likely malicious

25 0.009 1 0.634 1 0.684 16 0.757

0.472 0.626 0.634 0.634 0.684 0.684 0.854 0.978

Decisive predictions vs manifest labels (n=41) Decisive coverage φ 0.953 Precision / Recall / F1 0.688 / 0.440 / 0.537 Accuracy (selective risk R) 0.537 (0.463) TP / FP / TN / FN 11 / 5 / 11 / 14 Pooled AUROC of pb (n=43) 0.578 Strict-split validation (35 train / 8 val) Best val. F1 / AUROC / PR-AUC Brier / ECE (calibrated)† Fitted temperature T

0.667 / 0.438 / 0.482 0.496 / 0.505 20.00 (search bound)

† on the eight validation graphs that also fitted T

this host before and after infection, which capture is worse?) and demands a margin. The model separates the infected capture from its control by at least ε in 28.6% of pairs, never inverts by ε, and is near-tied in 71.4%. Set against the composition 9/4/1, this means that five of the nine strict wins, and the single strict loss, are decided by margins below 0.05. The model has a direction but no usable magnitude, and a sign test on the four pairs that clear the tolerance gives p=0.0625. Because the checkpoint had seen every pair, these are the most favourable numbers the representation can produce; an out-of-sample version could only be lower. The rule layer does no better on its own terms: the control is “hotter” than its infected partner on suspect count in 42.9% of pairs and on maximum process score in 57.1%.

Base-rate projection. Taken at face value, the decisive verdicts have sensitivity 0.44 (11/25; CI 0.24–0.65) and false-positive rate 0.31 (5/16; CI 0.11–0.59), a positive likelihood ratio of 1.41. By Bayes’ rule, PPV = TPR π/(TPR π + FPR(1 − π)) (Axelsson, 2000). At the corpus prevalence of 0.61 the precision is 0.69; at π=0.01 it is 0.014, 70.3 false alarms per true one, and at π=0.001 it is 0.0014. A verdict is more likely right than wrong at 1% prevalence only if its likelihood ratio reaches 99.

6.3. Calibrated binary path

6.4. Dual conformity and abstention Track D abstains on 42 of 43 snapshots (CI 0.88–1.00) and issues no decisive verdict at all (Table 7). Figure 2b explains the mechanism without reference to hyper-parameters: the malware-pattern and benign-conformity scores are close to one measurement taken twice. Both occupy overlapping bands (medians 0.636 and 0.646), they are correlated (Spearman ρ=0.72; Pearson r=0.80, which falls to 0.52 once the single snapshot at the origin is removed, so the rank correlation is the figure to rely on), 30 of 43 snapshots lie within |∆| < 0.05 of the identity line, and the margin that the fusion layer is meant to exploit has a median of 0.011, 2.6% of its range of 0.420. No axis of the plane separates the labels: pooled AUROC is 0.59 for m, 0.49 for −b and 0.60 for ∆. Given Section 6.1 this outcome is coherent. The benign encoder was trained without a single clean_benign row, so its notion of “normal” was induced from captures that the rule layer flags. One-class objectives presuppose uncontaminated

Track B assigns decisive states to 41 of 43 snapshots (Table 6), and the calibrated probability separates the bands as designed: ‘likely benign’ rows sit at a median of 0.472 and ‘likely malicious’ rows at 0.854, with the two ambiguous rows inside [τlow , τhigh ] = [0.632, 0.712] (the high/low qualifier refers to heuristic risk h(x), not to pb , which is why the high-risk row carries the lower probability). Agreement with the manifest is another matter. Selective accuracy is 0.537 (22 of 41 decisive snapshots; CI 0.37–0.69), or 0.512 overall if the two abstentions are counted as errors (22/43), with recall 0.440 and specificity 0.688 (11/16), and the dominant error cell is false negatives (14), that is malware-labelled captures scored as benign. Figure 2a shows why threshold tuning would not fix this. The two label populations interleave across essentially the whole probability range: several benign-labelled captures score above 0.9, one malware-labelled capture scores 0.009, and the medians differ by 0.04. Pooled over all 43 snapshots the calibrated probabilities give AUROC 0.578 (exact one-sided 11

1 shaded: |∆| < 0.05 0.7 band 0.5

9

Manifest tabular LR

Graph-attribute LR

5

3

11

0.6 GNN, strict order ∆= 0

0.25

malware-pattern m(x)

calibrated pb (x)

0.75

GNN, margin ≥ ε

0.5

9

4

1

10

4

0 benignlabelled

malwarelabelled

0.3

0.4

0.5

0.6

0.7

infected ranked first

tie

control first

benign-conformity b(x)

(a)

(b)

(c)

Figure 2: Score fields on the ML corpus; circles are benign-labelled and squares malware-labelled snapshots. (a) Calibrated malware probability by manifest label: the shaded ambiguity band is [0.632, 0.712] and bars are class medians (0.585 vs 0.625). (b) Dual-model score plane on equal axes: 30 of 43 snapshots lie within |∆| < 0.05 of the identity line; one malware-labelled snapshot at (0.000, 0.011) falls outside the window. (c) Composition of the 14 matched pairs implied by Proposition 1 and Table 5: equal LOFO means hide different behaviour, and only four GNN wins clear ε=0.05.

6.5. Gate ablation: abstention is not the gates’ fault

Table 7: Track D on the ML corpus: score ranges, routing under the calibrated preset, gate triggers, and the gate ablation of Section 6.5. Score Malware-pattern m(x) Benign-conformity b(x) Margin ∆ = m − b

Min

Median

Max

0.011 0.000 −0.126

0.636 0.646 0.011

0.717 0.726 0.294

Routing (preset calibrated) needs analyst review anomalous unknown likely malicious likely benign

42 (0.977) 1 0 0

Abstention triggers MC-dropout variance + low margin MC-dropout variance only Dual conflict + variance + margin Low margin only No gate fired Gate ablation disabled legacy_or calibrated

A natural objection is that the abstention policy is simply too conservative. The ablation in Table 7 rules this out. With every uncertainty gate disabled, 95.3% of snapshots (41/43; CI 0.84– 0.99) are still routed to review and decisive coverage remains exactly zero, because the fused score itself falls inside the triage band [0.40, 0.65) for 41 of the 43 snapshots and the remaining two are routed to ‘anomalous unknown’ before any gate (Section 4), so no snapshot receives a decisive state under any preset. The gates move the review rate by 2.4 percentage points; they do not cause the abstention. In risk–coverage terms the fusion path collapses to the single point φ=0 under every preset, where selective risk is undefined. Had we reported only the calibrated preset, the abstention could have been put down to policy and not to representation. This is why gate ablation belongs in the minimum reporting set for any abstaining detector.

28 12 1 1 1 Review 0.953 1.000 0.977

Decisive φ 0.000 0.000 0.000

Gated 0 43 42

Reference tabular baselines. For orientation only (the corpus view and protocol differ, so this is not a matched comparison), logistic regression and random forest over manifest graph-level features on the descriptive corpus achieve F1 of 0.469 and 0.631 with ROC-AUC 0.489 and 0.711. The random forest is the strongest single number in the MalVol-25 part of this study. We state it plainly, because leaving out a baseline that outperforms the proposed method is exactly the reporting practice that makes security ML results hard to trust (Arp et al., 2022).

normal data and degrade when that assumption fails (Ruff et al., 2021); whether the controls are in fact contaminated is unknown, but a reference set that the instrument cannot distinguish from the positive class is unfit for a conformity model either way. Fitted to ambiguous controls, the benign model learns the manifold of busy Windows hosts, which is also where the infected captures live. We therefore report Track D as a contaminated-control experiment, not as a benign conformity model: a benign one-class path cannot legitimately be trained on this corpus, and the architecture keeps it only so that the failure can be measured. We do not introduce surrogate or synthetic benign rows to make the path trainable. In the terms of Hendrickx et al. (2024), a novelty detector whose reference set already contains the novelty has nothing left to reject on. The gates then fire as designed (MC-dropout variance combined with low dual margin accounts for 28 of 42 abstentions), but they report a real property of the score field. They do not manufacture caution.

7. External validation on two public corpora Sections 6.1–6.5 rest on one dataset lineage and 43 snapshots, and the obvious objection is that MalVol-25 is simply an unusual corpus. We therefore repeated the audit on the two public Windows memory corpora on which detection results are reported: CIC-MalMem-2022 (Carrier et al., 2022), on which a logistic regression has been reported at 99.97% accuracy (Dener et al., 2022), and the memory-artefact corpus of Sihwail et al. (2021). Neither releases memory images, so neither supports the graph tracks of Section 4; both release the kind of Volatility-derived summary that the tabular rungs of the 12

stage ladder consume. The question is not whether our pipeline detects malware on them. It is what the protocol of Table 14 reveals when it is run on corpora of this type. Every number in this section is computed by one script from the two public files, whose checksums are given in the data-availability statement, with seed 2027; nothing is simulated or imputed.

Table 8: Provenance and governance audit of CIC-MalMem-2022. The benign class carries no provenance at all; the malware class carries a hash and a dump index that a random split ignores.

Item

Value

Rows / features 58,596 / 55 Benign- / malware-labelled 29,298 / 29,298 rows Provenance key on benign rows none Malware families / categories 15 / 3 Distinct binaries (by hash) 2,887 Dumps per binary, median 10 (1–20) (range) Binaries listed under two 19 (366 rows) families Repeated (binary, dump) keys 1,129 (467 byte-identical) Exact duplicate feature rows 569 (0 with conflicting class) Constant / near-constant (≤ 3 3/4 values) features Test malware rows whose 99.9% binary is also in training, random 5-fold

7.1. Corpora and what transfers CIC-MalMem-2022. The file holds 58,596 rows of 55 features extracted with VolMemLyzer (Lashkari et al., 2021), split evenly into 29,298 benign-labelled and 29,298 malware-labelled rows from fifteen families in three categories (spyware 10,020; ransomware 9,791; trojan 9,487). Each malware row carries a category string of the form Category-Family-hash-k.raw; each benign row carries the single word Benign. The features are plugin summaries (process, DLL, handle, ldrmodules, malfind, psxview, service and callback counts), so the injection and hidden-process indicators of Table 2 have direct counterparts; there is no network plugin, so the C2 indicator has none.

Benign rows with ≥ 1 / ≥ 3 injected regions Benign rows with a process absent from pslist Surrogate label_quality_ flag on benign rows

The corpus of Sihwail et al. (2021). The paper describes 2,502 malware and 966 benign samples with 8,898 memory features extracted from memory images: API names resident in memory, DLLs, handles, privileges, network connections and injected code. The file in the repository the paper names is published as a sample and has the 3,468 rows but 28 of the columns, all binary: nineteen API-presence flags, seven privilege flags and the two indicators Malfind and Netscan, which are the closest public analogues of the injection and C2 indicators used throughout this paper. We use it for the indicator-level items of the protocol only, and nothing in this section re-evaluates the authors’ full feature space or their memory images.

100% / 98.3% 40.7% 29,298/29,298

scaling and the inner temperature split are fitted on the training fold of each design. Item 5 loses its point when folds hold thousands of rows, so we report fold dispersion and the sign test over families instead. Items 6 and 7 apply unchanged to the out-of-fold probability field: temperature fitted on an inner family-held-out split, Brier score and ECE over fifteen equalwidth bins, and the triage band [0.40, 0.65) of Algorithm 1 with a two-model disagreement gate as the analogue of binary–dual disagreement.

What transfers. Items 1 and 2 of Table 14 transfer directly, with the two recorded reasons that exist in the features (a non-zero injection count, a process absent from pslist) standing in for the rule verdict as a surrogate label_quality_flag. Item 3 does not: neither corpus has matched controls, so there are no pairs to rank. Item 4 becomes a ladder of tabular rungs, logistic regression over all features, over the nine rule-type indicators alone, a random forest, and the single feature chosen on the training fold, run under three split designs of increasing severity: stratified random folds (the design behind the published figures), folds that hold out whole binaries, and leaveone-family-out; benign rows, having no key, are assigned to folds at random with a fixed seed. Two details of the grouping matter. A binary that the file lists under two families is assigned to a single by-binary group, and when either of its families is held out it is removed from training as well, so no test binary has a dump in training under the by-binary or by-family designs (the leakage row of Table 10 is 0 for both). The benign rows cannot be grouped at all, so both designs hold out binaries or families on the malware side only; what they estimate is independence from the malware binary or family, not from the benign host, and Section 7.2 reads them accordingly. All

7.2. CIC-MalMem-2022 Provenance audit. Table 8 records what the governance schema of Section 3 can and cannot be filled with. On the malware side the category string identifies 2,887 distinct binary identifiers (2,329 of SHA-256 length, 515 of MD5 length and 43 truncated to 21 or 31 characters, none a prefix of another), each contributing a run of dumps (k = 1, . . . , 10; median ten per binary), so the corpus has a group structure that the usual stratified split ignores: in a random five-fold split, 99.9% of test malware rows have another dump of the same binary in the training set. The strings also contain outright conflicts. Nineteen identifiers, all of SHA-256 length, appear under two families, in every case Emotet and one of 180solutions, Pysa, CWS, Conti, Transponder or Shade, with different feature vectors under each label; 1,129 (binary, dump) keys occur twice, 467 of them as byte-identical rows. On the benign side there is nothing to audit. The 29,298 benign rows carry no host, session, 13

Table 9: Indicator gaps on CIC-MalMem-2022 (class means; δk is malware minus benign). The last column is the AUROC of the raw feature with malware as the positive class, so values below 0.5 mark an inverted indicator. The nine rows above the rule are the rule-type indicators used in the ladder of Table 10; those below are host-population counts. Indicator

Benign Malware

δk

AUROC 0.279

Injected regions (malfind) medians Unique injections Injection commit charge Processes absent from pslist other two psxview views Unlinked modules, not_in_load Unlinked modules, not_in_init not_in_mem

4.96 4 1.37 10.3 1.69

9.06 +4.11 3 2.10 +0.73 1,928 +1,918 2.07 +0.38

75.6 115.3 75.6

46.1 84.6 46.1

Kernel callbacks Services Processes Handles DLLs loaded DLLs per process Handles per process

87.7 394.2 42.5 12,119 2,083 48.9 286.8

86.1 −1.7 388.5 −5.7 40.3 −2.3 8,398 −3,721 1,539 −543 38.5 −10.4 212.3 −74.4

Table 10: Stage ladder on CIC-MalMem-2022 under three split designs (AUROC, fold mean with the fold SD as subscript). Holding out binaries or whole families changes nothing: the separating signal is not family-specific, and a single feature carries all but 0.003 of it. Rung

0.152 0.195 0.594 0.594 / 0.603 −29.5 0.024 −30.7 0.040 −29.5 0.024

Random 5-fold By binary (10) By family (15)

Single feature, chosen on train LR, 9 rule-type indicators LR, all 55 features Random forest, all 55

0.9975±.0003 0.9842±.0011 1.0000±.0001 1.0000±.0000

0.9974±.0008 0.9842±.0036 0.9999±.0001 1.0000±.0000

0.9971±.0055 0.9842±.0064 0.9998±.0003 0.9998±.0009

Accuracy at 0.5, LR / RF Test binaries seen in training Folds with AUROC > 0.5, LR

0.999 / 1.000 0.999 5/5

0.999 / 1.000 0 10/10

0.998 / 0.999 0 15/15

The feature chosen on every training fold of every design is dlllist.avg_ dlls_per_proc. Sign test over the 15 families, LR and RF: p = 3 × 10−5 .

0.126 0.004 0.323 0.017 0.022 0.003 0.007

a busier host image than the malware captures, and the label is recoverable from how busy the host is. Which of the three causes of Section 3 produces it cannot be decided from the features, and without per-row provenance it cannot be decided at all.

binary or dump identifier, so they cannot be grouped, paired or traced to a capture. The benign_subtype field, however, can be filled: every benign row records at least one injected region (malfind.ninjections ≥ 1 on 29,298 of 29,298; ≥ 3 on 98.3%), and 40.7% record a process absent from pslist. Under the surrogate rule the label-quality flag is set on the entire benign class (exact 95% lower bound 0.9999), and no row qualifies as clean_benign. The finding of Table 2 is therefore not a MalVol-25 peculiarity; it holds, with 1,953 times as many benign rows, on the corpus the field treats as its benchmark.

Stage ladder under three split designs. Table 10 first reproduces the literature: with stratified random folds, logistic regression reaches accuracy 0.999 and the random forest 1.000, in line with the 99.97% that Dener et al. (2022) report for logistic regression. In that design 99.9% of test binaries are also in training, so the number describes the recognition of dumps that were seen nine times over. Removing the leakage does not lower it. When whole binaries are held out, and when whole families are, AUROC stays at 0.9998 or above for both models (by-family fold SD 0.0003 and 0.0009), every one of the fifteen families is ordered above chance and the sign test gives p = 3 × 10−5 . The separating signal is therefore not something the models learn from other dumps of the same binary or other members of the same family; it is present in the benign–malware contrast itself. These two designs are groupindependent on the malware side only. The benign rows carry no key, so the same benign host, if there was one, sits in every training and every test fold, and a by-family AUROC of 0.9998 is not evidence that the model would separate an unseen benign host from an unseen family; the single-feature rung shows what it does separate. Read across, the ladder says how much of it is learned. A single feature chosen on the training fold scores 0.997 in all three designs, and it is the same feature every time, the mean number of DLLs per process of Table 9. The learned rungs add 0.003 to it. The nine rule-type indicators reach 0.984 on their own, but Table 9 shows why: six of the nine point the wrong way, so the regression separates the classes by weighting them against the direction a rule layer would use. On MalVol25 the ladder was flat at 0.786, the smallest value the design could call significant; here it is flat at 1.000. Both flat ladders mean the same thing, that the learned component is inert, once because there is no signal in the label and once because the signal is saturating, trivially available and unrelated to the indicators a forensic rule would cite.

Indicator gaps. Table 9 and Figure 3 repeat the second finding of Section 6.1. All three injection-type indicators are rankinverted. The raw count and the commit charge have positive mean gaps only because of heavy malware tails (for the count, a 95th percentile of 61 and a maximum of 627 against 12 and 21 on the benign side); the median count is 4 on benign rows and 3 on malware rows, a benign row shows more injected regions than a malware row in 72% of cross-class comparisons (AUROC 0.279) and more unique injections in 85% (AUROC 0.152). Of the nine rule-type indicators only the three hiddenprocess views run the expected way, and weakly (0.59–0.60); the three unlinked-module counts run strongly the other way, with 64% more ldrmodules entries absent from the load list on benign rows. Every host-population count runs the wrong way for a rule that reads volume as risk: the benign-labelled rows carry more services, more processes, more handles and more loaded DLLs. Two of these counts identify the class for the great majority of rows. Seventy-three per cent of benign rows record exactly 395 services and a further 25% exactly 392, whereas 93% of malware rows record exactly 389; and the mean number of DLLs per process separates the classes with AUROC 0.9975 (5th–95th percentiles 43.6–52.3 on benign rows, 36.5–40.1 on malware rows), so that a single threshold at 42.6 DLLs per process, chosen post hoc on the whole corpus and reported as an exploratory illustration rather than as an out-of-fold result, classifies 98.7% of it. This is what a difference in host state looks like: the benign captures come from

Calibration, abstention and base rates. Table 11 is the mirror image of Tables 6 and 7. On the out-of-fold field the Brier 14

(b) 0.8 benign-labelled malware-labelled

120

0.62

share of class

unlinked modules (ldrmodules.not_in_load)

(a) 140

100 80

0.6

0.39

0.4 0.29

60

0.22

0.2 40

0.11

0.10

0.07

20

0.0 30

35 40 45 50 DLLs per process (dlllist.avg_dlls_per_proc)

55

0.08

0.08 0.03

0.02

0.00

1–2 3 4 5–9 10–49 ≥50 injected regions per dump (malfind.ninjections)

Figure 3: CIC-MalMem-2022. (a) Two host-population features for a fixed-seed random subsample of 300 rows per class (seven of the 600 sampled rows fall outside the plotted window and are not drawn); benign-labelled rows (circles) are the busier hosts, and the classes barely overlap. (b) Class-conditional share of rows by injected-region count over all 58,596 rows: the benign mass sits to the right of the malware mode at 3, and only the malware tail beyond 50 runs the other way. A benign row shows more injected regions than a malware row in 72% of cross-class comparisons.

Table 12: Indicator-level audit of the public sample of Sihwail et al. (2021) (n=3,468; 966 benign-labelled, 2,502 malware-labelled). Exact 95% Clopper– Pearson intervals for the benign shares are 0.50–0.57 and 0.02–0.04; LR+ and PPV treat a set flag as a decisive malware verdict, PPV at 1% prevalence.

Table 11: Calibration, abstention and base rates on the leave-one-family-out probability field of CIC-MalMem-2022 (n=58,596; band [0.40, 0.65) of Algorithm 1). Every artefact that failed on MalVol-25 passes here. LR

LR, T -scaled

RF

Routing (review rate) band only, LR / RF / fused mean legacy_or (band on either, or disagree) Decisive verdicts, fused mean, gates disabled Coverage φ / selective risk R TPR / FPR Likelihood ratio LR+ PPV at π = 0.01 / 0.001

LR+

PPV0.01

Malfind (injection) 0.534 (516/966) 1.000 (2,502) 1.87 Netscan (connection) 0.031 (30/966) 0.552 (1,381) 17.8 Both 0.006 0.552

0.019 0.152

Indicator set

Brier score 0.0016 0.0016 0.0011 ECE (15 bins) 0.0012 0.0014 0.0014 Pooled AUROC 0.9998 0.9997 Median p, benign / malware 0.000 / 1.000 0.000 / 1.000 Fitted T over 15 folds: 0.75–1.58, median 1.07, none at a search bound

Benign

Malware

Distinct feature vectors among 3,468 rows: 74; vectors carrying both labels: 9 Family or host key: none; LR over 28 columns, stratified 5-fold: AUROC 0.917 ± 0.010, accuracy 0.785 against a majority-class 0.722

0.0003 / 0.0002 / 0.0009 0.0016 (30 + 61) 0.9991 / 0.0011 0.998 / 0.0002 5,844 0.983 / 0.854

7.3. The corpus of Sihwail et al. (2021): an indicator-level replication The published sample of the second corpus supports only the indicator-level items, and Table 12 gives them. The injection indicator is set on every malware row and on 53.4% of benign rows (exact interval 0.50–0.57). Taken as a detector, it has sensitivity 1.0, a false-positive rate of 0.53 and a likelihood ratio of 1.87, the same order as the 1.41 of Track B on MalVol-25, and at 1% prevalence its positive verdict would be right once in fifty-four. The network-connection flag is the informative one here: set on 3.1% of benign rows and 55.2% of malware rows, it carries a likelihood ratio of 17.8, and even so its projected precision at 1% prevalence is 0.15. Nothing further can be audited. The sample has no family or host key, and its 28 binary columns collapse 3,468 rows onto 74 distinct feature vectors, nine of which occur under both labels, so a stage ladder or a permutation null would measure the two indicators and little else. The one number we report from a model, a logistic regression at AUROC 0.917 and accuracy 0.785 against a majority-class 0.722, says as much.

score is 0.0016 and ECE 0.0012 before any temperature is fitted; the fitted temperatures lie between 0.75 and 1.58, well inside the search range, and change nothing. The medians of the two classes sit at 0.000 and 1.000. The triage band catches 0.09% of the corpus, the disagreement gate adds 61 rows, and the legacy_or preset still routes only 0.16% to review. Decisive coverage is 0.999, the likelihood ratio of a decisive verdict is in the thousands, and the projected precision at 1% prevalence is 0.98. By the argument of Section 3, every one of these numbers measures agreement with provenance, and Tables 8 and 9 say what that provenance is: a host fingerprint. The abstention machinery is not at fault. The gates are built to notice variance, disagreement and low margin, and a shortcut produces none of them; as Section 4 put it, an overconfident head is not evidence of uncertainty, and the converse also holds, a confident head is not evidence of a compromise signal. Items 6 and 7 of the protocol, on their own, would have certified this corpus. Items 1 and 2, and the single-feature rung of item 4, are what reveal the problem, which is why the protocol reports them first.

7.4. Cross-corpus synthesis Table 13 places the three corpora side by side. In none of them does the benign class behave like a verified benign class: on MalVol-25 every control is flagged and two headline indicators are inverted; on CIC-MalMem-2022 every benign row car15

Table 13: The seven reporting artefacts of Table 14 on three corpora. The learned-metric items (4–7) range from failing to passing perfectly; the label-quality items (1–2) fail on all three. Artefact

MalVol-25, ML view (n=43)

CIC-MalMem-2022 (n=58,596)

Sihwail et al. 2021, sample (n=3,468)

1. Label-quality fields

18/18 benign rows flagged, 0 train-eligible; paired controls with host provenance

Malfind set on 516/966 benign rows; no key; 74 distinct vectors, 9 under both labels

2. Mismatch rate and indicator gaps

µ ≥ 0.73; injections −0.80, C2 −1.93 (inverted)

3. Within-pair rank diagnostics

rank accuracy 0.286, near-tie 0.714, inversion 0 (frozen checkpoint, in-sample) 0.643 → 0.786 → 0.786; ∆(GNN − attribute LR) = 0.000 (GNN rows in-sample) p = 0.044 at B = 500 (across pairs, rescored checkpoint); 0.786 is the smallest significant mean of a decided design; p = 0.011 with ties dropped, 0.212 with ties as losses T = 20.00 at the bound; 0.496; 0.505 0.977; 0; 0.953 with gates off; 0.014

surrogate flag on 29,298/29,298 benign rows; no benign provenance key; 19 binaries under two families; 467 duplicate rows injections rank-inverted (benign ≻ malware in 72% of comparisons, 85% for unique injections); services, DLLs, handles, unlinked modules all higher on benign rows no matched controls: ten dumps per binary, none clean 0.997 (one feature) → 0.984 (indicators) → 1.000 (LR, RF); flat across random, by-binary and by-family splits 15/15 families above chance, p = 3 × 10−5 ; fold SD ≤ 0.001

T ∈ [0.75, 1.58]; 0.0016; 0.0012 0.0009; 0.999; 0.0016 with gates on; 0.983

not supported flag as verdict: PPV 0.019 (injection), 0.152 (connection)

a silent model on an unverified benign class

a confident model on a host fingerprint

instrument noise on half of the benign class

4. Stage ladder

5. Null, fold count, design power

6. Temperature, Brier, ECE 7. Review rate, coverage, gate ablation, PPV at 1% Reading

injection flag: +0.47 in share; connection flag: +0.52 not applicable LR over 28 columns 0.917; two indicators carry it no groups, no null

host state are unknown. Nor does it establish that the graph network cannot learn; it establishes that this corpus cannot show that it has. The CIC-MalMem-2022 result is the sharper lesson for the field: a model can be calibrated, decisive and correct on every held-out family and still be scientifically invalid as a detector, because what it has learned is the capture condition. A high score is not a reason to trust a model; a verified benign class is.

ries injected regions, two injection indicators are rank-inverted, and the benign rows are the busier hosts; on the Sihwail sample the injection indicator fires on half the controls. What differs is what the learned-metric artefacts say. On MalVol-25 they fail, and the model is silent. On CIC-MalMem-2022 they pass without exception, and the model is confident, because one hostpopulation feature separates the classes on its own and survives every hold-out we can construct. The two outcomes are opposite ends of the same defect. A corpus whose benign class is asserted by provenance can carry no label-related signal at all, or it can carry a signal that is entirely about provenance; in both cases a detector trained on it is right about the data and wrong about the world, and in neither case do calibration, coverage or a base-rate projection notice. This is the argument for the order of the protocol. Items 1 and 2 are cheap, they need no model, and on all three corpora they are the items that fail.

Silence and shortcut. Section 7 shows that the protocol has two failure modes to catch, not one. On MalVol-25 the learned component is silent: no rung of the ladder is separable from the resolution of the design, the probability field carries no confidence information and the fusion path abstains. On CIC-MalMem2022 it is confident: the ladder is flat at 1.0 under every split, the field is calibrated and decisive, and abstention is negligible. The label-quality items fail on both, and for the same reason, that the benign class was asserted rather than verified. A reviewer who saw only items 4 to 7 would reject the first corpus and accept the second; items 1 and 2 show that the second is the more dangerous of the two, because its detector will be deployed. The single-feature rung is the cheapest guard against the shortcut: if one plugin count matches the full model, the model has learned the capture condition, whatever else it has learned.

8. Discussion: a validation protocol Table 14 collects the instrumentation into a protocol. All seven items were produced by scripts that were already needed to run the pipeline, and each can falsify a claim the paper might otherwise have made. What the evidence establishes, and what it does not. The evidence establishes four things. On MalVol-25 a transparent rule instrument contradicts the benign label on every control and two headline indicators run the wrong way; on CIC-MalMem2022 every benign row carries injected regions and the classes are separated by host-population counts that no forensic rule would cite; on the Sihwail sample the injection indicator fires on half the benign class; and on MalVol-25 a graph model that has seen every fold cannot order the pairs by a usable margin and the fusion path never decides. The evidence does not establish that any control was compromised: µ measures discordance between two imperfect witnesses, the three causes of Section 3 are not apportioned, and the rule layer’s own error rates against

Label provenance is a system artefact, not a caveat. Once train_eligible=False on 18 of 18 benign rows is machinereadable, a strict trainer cannot silently proceed, and a reader can verify in one query that no clean benign manifold existed. For corpus builders the implication is concrete. A benign baseline should be verified, not merely captured before detonation: built from known-good media, with loaded images allow-listed against reference hashes, resident security tooling enumerated, and acquisition tool and timing recorded. The outcome should ship as per-row fields in the dataset’s documentation (Grajeda et al., 2017). CIC-MalMem-2022 shows what their absence costs: its benign rows carry no provenance at all, so the corpus 16

Table 14: Reporting protocol for learned forensic triage on corpora whose ground truth is asserted rather than verified. Each item is a falsifiable artefact, not a narrative caveat.

Report

Rationale

Per-row label-quality fields

Distinguishes a verified benign class from an asserted one; makes strict-training eligibility auditable. Mismatch rate µ and indicator gaps δk , Reveals mismatch directly: here µ ≥ 0.73 and two of three gaps are inverted; on with the AUROC of each raw indicator CIC-MalMem-2022 the injection indicators are rank-inverted while one host-population count reaches AUROC 0.997 under leave-one-family-out validation. Within-pair rank accuracy, near-tie and Aggregate AUROC over matched pairs is dominated by between-family variance that inversion rates at a stated ε does not transfer. Stage ladder against a feature-only Separates learned structure from re-expression of the rules that curated the corpus; equal baseline, with W/T/L, each rung means can hide different compositions; a ladder that is flat at 1.0 is as diagnostic as one marked as refitted per fold or scored by that is flat at 0.786; an in-sample diagnostic must not be read as an out-of-sample a frozen checkpoint, under random, estimate. by-binary and by-family splits Permutation null with B, fold count, A mean over 14 two-graph folds is not an effect size; 0.786 is the smallest mean a SD, Monte-Carlo error, tie handling and decided design of 14 pairs can call significant, and a significance that disappears when design power ties count as losses is not one. Fitted temperature, Brier, ECE A boundary temperature with ECE near 0.5 signals an uninformative probability field. Review rate, decisive coverage, gate Distinguishes conservative policy from a degenerate score field, and prices the ablation, base-rate PPV examiner’s workload.

cannot be grouped, paired or audited on the benign side, and the host-state difference that separates its classes can neither be explained nor removed. This is in line with recent work that makes the origin of the data part of a forensic dataset’s description (Breitinger and Jotterand, 2023) and ties data set creation to stated principles and use cases (Göbel et al., 2025). Verifying the clean half is the item we would add to those lists.

erty of the host. Latent contamination is tested by rebuilding the guest offline from known-good media and capturing again. A benign memory baseline should therefore carry, per row, its build source and image hash, the acquisition method (tool, version, guest paused or live), uptime at capture, the resident security tooling, the share of loaded images and executable private regions attributed to known-good hashes, and the rule verdict after allow-listing with the name of the reviewer. Each field is cheap to produce while a corpus is being built, and none can be reconstructed afterwards.

Telling the three causes apart. The three causes of Section 3 call for different remedies, and ordinary forensic means are enough to separate them. Acquisition artefacts are excluded when the guest is paused and its memory is read by the hypervisor: such a snapshot is atomic in the sense of Pagani et al. (2019), every page reflecting one instant, and Ottmann et al. (2024) report snapshots of frozen systems as consistent in their measurements. Atomicity is a property of the copy, not of the state copied: a kernel structure that was mid-update at the instant of the pause is captured mid-update, so a paused snapshot removes the acquisition cause and leaves the other two untouched. Live acquisition with an in-guest tool, by contrast, adds inconsistencies of its own (Rzepka et al., 2024), and the dataset descriptor does not say which method produced the dumps. Instrument noise can be measured by attributing every flagged region, hook and connection on a baseline to the module that owns it and checking that module against known-good hashes. What is left after allow-listing is the residue that needs an explanation. Allow-listing has a known blind spot: it clears what it recognises, and a region attributed to a signed module can still have been modified in memory (Block, 2023), so the residue is a lower bound on what needs explaining. Repeated baseline captures of the same guest add a second check: an indicator that varies between two captures of an unchanged host is instrument or acquisition noise, one that is stable is a prop-

Paired controls demand rank diagnostics. Aggregate AUROC over matched pairs is dominated by between-family variance, which is exactly the variance that does not transfer. The withinpair questions are harsher and closer to practice, and low rank accuracy together with zero inversions is diagnostic in itself: the model is not wrong, it is silent, and no aggregate metric expresses that. Abstention rate is a result, not a safety feature. A system that routes 97.7% of inputs to a human has not achieved safety. It has moved the workload. Because abstention is easily presented as conservatism, review rate, decisive coverage and a gate ablation should be reported together; here that triple is what separates “cautious policy” from “degenerate score field”. Hybrid rule–learning systems leak by construction. When the same rule engine both curates the corpus and supplies graphlevel features, apparent learning may be re-expression (Kapoor and Narayanan, 2023). Equal LOFO means for attribute-only regression and the GNN, and a 0.000 delta between pooling variants, are consistent with re-expression; they do not prove it, because the profile ablation that would separate the two readings was not run. A learned model that adds 0.003 to a single 17

plugin count, as on CIC-MalMem-2022, is the same finding from the other side. The leakage-controlled comparison that the architecture was built to support, and that this study did not complete, is a ladder with nine rungs under one protocol: the rule layer alone; logistic regression and a random forest over manifest features; a single-feature shortcut baseline chosen on the training fold; the GINE model under the full, no_ manifest_leakage and structure_only profiles, each refitted without the held-out family; suspect-mask pooling; and the within-pair diagnostics for every rung. Preprocessing, feature selection, early stopping, the temperature and every threshold must be fitted inside the training fold. Until that ladder is run on a corpus with verified benign rows, the leakage finding of this paper is the weaker one: equal means and a zero pooling delta, not a demonstrated absence of structural information.

give 80% power against a model that orders three pairs in four correctly, and a corpus meant to detect a weaker effect needs more. The analysis plan is fixed in advance: per-rung refitting without the held-out family, exact enumeration of the withinpair null, ties reported under both conventions, nested calibration, the nine-rung ladder above, and every artefact of Table 14 published with the corpus. Essential to a detection claim are the verified baselines, the per-fold refit and the leakage profiles; the repeated captures and the acquisition-method arm are what would let the three causes be apportioned. 9. Limitations and threats to validity External validity is the binding constraint: n=30 and n=43 snapshots over 15 families, one dataset lineage, virtualised guests. Nothing here characterises graph learning on memory forensics in general. It characterises what can be measured on a small paired corpus without verified benign ground truth. The GNN results in particular are in-sample diagnostics of one frozen checkpoint, so no statement about generalisation to an unseen family is made or available; the per-fold refit that would provide one was not run, and neither were the two leakagecontrolled profiles. The external corpora of Section 7 widen the claim about corpora, not the claim about the pipeline: they release plugin summaries, not images, so the graph tracks were not run on them, the label-quality flag there is a surrogate built from two recorded reasons rather than the rule layer’s verdict, and the split designs could group only the malware side because the benign rows carry no key. The Sihwail sample is a column subset of its corpus and supports indicator-level claims only. We do not know how the two classes of CIC-MalMem2022 were captured, so the host-state difference we measure is a finding about the file, not an explanation of it. Statistical conclusion validity is correspondingly weak: every interval is wide, LOFO folds contain two graphs, the design detects a model that orders three pairs in four correctly with probability 0.52, and Table 4 is ordinal, not an effect size; the one significant GNN value depends on dropping four saturated ties, the permutation null was drawn across pairs and rescored a fixed checkpoint, and the Track B calibration figures come from eight graphs that also fitted the temperature. Construct validity is the subject of the paper. Folder provenance is an imperfect operationalisation of compromise, and the rule layer is itself an unvalidated instrument, so µ measures disagreement between two imperfect witnesses and not contamination. We cannot say which of the three causes of Section 3 dominates; doing so needs baselines whose cleanliness has been established independently, and the title of the paper is chosen to say exactly that: the benign class is unverified, which is all the evidence shows. Internal validity risks include schema drift between manifest versions and artefacts of graph construction, which health flags and artefact contracts mitigate but do not remove; the health flags certify parseable output, not correct output. Acquisition is a limitation in its own right: the descriptor records neither the acquisition tool nor whether guests were paused, so the share of indicators that the capture itself produced is unknown for every row, and the chain of custody of the public images is the dataset’s, not

Evidential weight. Evaluative opinions weigh how probable the observations are under competing propositions (Casey, 2020), and the output of an automated system can enter that reasoning only once its performance has been characterised (Bollé et al., 2020). For Track B the characterisation is a likelihood ratio of 1.41: a ‘likely malicious’ verdict makes compromise 1.41 times more probable than before the tool ran, which is negligible support. Implications for practice. For an examiner, the rule layer and its evidence pointers remain usable whatever the learned components do, which is why the architecture keeps them independent. The learned scores should not yet inform a triage decision: a near-tie rate of 0.71 is an error characteristic that a validation report would have to disclose (Horsman, 2019), and a system that abstains on 42 of 43 inputs has not demonstrated operational triage at all; it has demonstrated that its score field cannot be thresholded. Nothing here argues against learning as such. Where ground truth is adjudicated at artefact level and the decision process is explicit, as in the Registry triage of Ghanem et al. (2026), the same questions can be answered with more confidence than snapshot labels allow. A paired corpus that would support a detection claim. The experiments this paper could not run define the corpus that would allow them, and we set it out as a proposal, not as work done. Each family contributes a clean baseline and a matched infected capture of the same guest, with the baseline verified as described above: built from known-good media with the image hash recorded, loaded modules and executable private regions attributed to allow-listed hashes, resident security tooling enumerated, the rule layer run after allow-listing and its residue adjudicated by a named examiner. Acquisition is by hypervisor snapshot of the paused guest, with the tool, version and uptime recorded, and each baseline is captured at least twice so that instrument and acquisition noise can be separated from host state. The design should span at least two Windows releases, two host configurations (with and without a third-party security product) and two acquisition methods (paused snapshot and in-guest live tool) on a subset, so that each factor’s contribution to µ can be estimated. The sample size follows from Section 6.2: 28 pairs 18

ours. Derived statistics rest on values reported to three decimals, adversarial robustness is not evaluated, and all results are inference-time evaluations of frozen checkpoints. Independent ground truth is absent by construction on all three corpora, and no analysis in this paper can supply it; the proposal of Section 8 is the only route to it.

and the frozen checkpoints behind every reported number; the two manifest views with the governance fields; the constructvalidity report and the per-sample score files from which Figure 2 is drawn; the derived-statistics, external-audit and figure scripts with an environment file; SHA-256 checksums of every released file; and a README that reproduces each table from the archive. The underlying memory images are public (Dunsin et al., 2025b) at https://doi.org/10.21227/kg5b-nf37. The external audit of Section 7 uses two public files as distributed by their authors, Obfuscated-MalMem2022.csv (58,596 rows, MD5 9e1be3f2b0393d5d287dae5d529f356a) and memory_dataset_sample.csv from the repository named in Sihwail et al. (2021) (3,468 rows, MD5 2ab6bf8a7355cef62d83912bb74d7ce7); the script that computes every number in that section and regenerates Figure 3 accompanies the artefacts.

10. Conclusion We set out to build a graph-based malware triage system over Windows memory forensics and ended up with a validation study, because the corpus would not support the claim the architecture was designed to make. Every benign-labelled snapshot carries a label-quality flag; that is, a transparent instrument contradicts the label on every control, which shows the benign class to be unverified and no more. Injection and C2 means run higher on the benign side. The learned model matches rule-attribute logistic regression in mean, differs from it in fold composition and is invariant to pooling, and even with every pair in its training set it separates an infected capture from its own control by a meaningful margin in 28.6% of pairs; and the fusion layer abstains on 97.7% of inputs for reasons that survive the removal of every uncertainty gate. Each statement is a measurement, produced by instrumentation that a detectionfocused pipeline would have had no reason to build. The audit does not depend on the corpus. On CIC-MalMem-2022 the benign class is flagged in its entirety, the injection indicators are rank-inverted, and the 99.9% accuracy of the literature reduces to one host-population feature that survives every hold-out the file allows; on the sample of Sihwail et al. (2021) the injection indicator fires on half of the benign class. A silent model and a confident model are two outcomes of the same unverified benign class, and only the label-quality items of the protocol tell them apart from a working detector. The methodological contribution is therefore not a detector but a way of reporting: label-quality fields, the mismatch rate and indicator gaps, fold compositions with their tie convention, the in-sample or out-ofsample status of every rung, and the abstention rate with its ablation, as artefacts a reviewer can check. Three pieces of work follow directly: a paired memory corpus with independently verified baselines and at least the 28 pairs that Section 6.2 asks for, a per-fold refit of the graph model with exact enumeration of the within-pair null in place of Monte-Carlo permutation, and the first run of the leakage-controlled profiles on that corpus. Learned forensic triage needs corpora whose benign class has been verified, not asserted. Until it has them, the responsible contribution is to measure the gap and report it.

CRediT authorship contribution statement Viraj Rajeshbhai Chudasama: Conceptualization, Methodology, Software, Investigation, Formal analysis, Writing – original draft. Eduardo Palmieri: Resources, Data curation, Validation, Writing – review & editing. Dipo Dunsin: Resources, Data curation, Validation, Writing – review & editing. Aisha Junejo: Validation, Writing – review & editing. Mohamed Chahine Ghanem: Conceptualization, Methodology, Supervision, Project administration, Writing – review & editing. Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Three of the authors are also authors of the MalVol-25 dataset on which part of the study is conducted; the dataset is public and is cited in the third person. Funding This research did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors. Declaration of generative AI and AI-assisted technologies in the manuscript preparation process During the preparation of this work the authors used Claude (Anthropic) for language editing, LATEX formatting and the drafting of the derived-statistics and external-audit scripts described in Section 5, which the authors reviewed, ran and checked. After using this tool, the authors reviewed and edited the content as needed and take full responsibility for the content of the publication. No experimental result was invented, extrapolated or altered by a generative tool.

Data availability The pipeline, manifests, analysis files, and the derivedstatistics scripts will be released on acceptance, as one archive containing: the extraction and graph-construction code with the Volatility 3 release and symbol-table source pinned; the graph schema and the rule-layer configuration (indicator weights and band thresholds); the model configurations, random seeds 19

References

Dunsin, D., Ghanem, M.C., Ouazzane, K., Vassilev, V., 2024. A comprehensive analysis of the role of artificial intelligence and machine learning in modern digital forensics and incident response. Forensic Science International: Digital Investigation 48, 301675. https://doi.org/10.1016/j.fsidi.2023.301675.

Airola, A., Pahikkala, T., Waegeman, W., De Baets, B., Salakoski, T., 2011. An experimental comparison of cross-validation techniques for estimating the area under the ROC curve. Computational Statistics & Data Analysis 55, 1828–1844. https: //doi.org/10.1016/j.csda.2010.11.018.

Frénay, B., Verleysen, M., 2014. Classification in the presence of label noise: A survey. IEEE Transactions on Neural Networks and Learning Systems 25, 845–869. https: //doi.org/10.1109/TNNLS.2013.2292894.

Apruzzese, G., Laskov, P., Montes de Oca, E., Mallouli, W., Búrdalo Rapa, L., Grammatopoulos, A.V., Di Franco, F., 2023. The role of machine learning in cybersecurity. Digital Threats: Research and Practice 4, 8:1–8:38. https://doi.org/10.1145/ 3545574.

Gal, Y., Ghahramani, Z., 2016. Dropout as a Bayesian approximation: Representing model uncertainty in deep learning, in: Proceedings of the 33rd International Conference on Machine Learning, pp. 1050–1059. https://proceedings.mlr.press/v48/ gal16.html.

Arp, D., Quiring, E., Pendlebury, F., Warnecke, A., Pierazzi, F., Wressnegger, C., Cavallaro, L., Rieck, K., 2022. Dos and don’ts of machine learning in computer security, in: Proceedings of the 31st USENIX Security Symposium, USENIX Association. pp. 3971–3988. https://www.usenix.org/conference/usenixsecurity22/ presentation/arp.

Ghanem, M.C., Wojtczak, D., Benkhelifa, E., Kheddar, H., Nepomuceno, E.G., Li, W., 2026. Leveraging reinforcement learning for an efficient Windows Registry analysis during cyber incident response. Scientific Reports 16, 26867. https://doi.org/ 10.1038/s41598-026-57787-6.

Axelsson, S., 2000. The base-rate fallacy and the difficulty of intrusion detection. ACM Transactions on Information and System Security 3, 186–205. https://doi.org/ 10.1145/357830.357849.

Göbel, T., Breitinger, F., Baier, H., 2025. Optimising data set creation in the cybersecurity landscape with a special focus on digital forensics: Principles, characteristics, and use cases. Forensic Science International: Digital Investigation 52, 301882. https:// doi.org/10.1016/j.fsidi.2025.301882.

Bilot, T., El Madhoun, N., Al Agha, K., Zouaoui, A., 2024. A survey on malware detection with graph representation learning. ACM Computing Surveys 56, 278:1–278:36. https://doi.org/10.1145/3664649.

Grajeda, C., Breitinger, F., Baggili, I., 2017. Availability of datasets for digital forensics – and what is missing. Digital Investigation 22, S94–S105. https://doi.org/10. 1016/j.diin.2017.06.004.

Block, F., 2023. Windows memory forensics: Identification of (malicious) modifications in memory-mapped image files. Forensic Science International: Digital Investigation 45, 301561. https://doi.org/10.1016/j.fsidi.2023.301561.

Guo, C., Pleiss, G., Sun, Y., Weinberger, K.Q., 2017. On calibration of modern neural networks, in: Proceedings of the 34th International Conference on Machine Learning, pp. 1321–1330. https://proceedings.mlr.press/v70/guo17a.html.

Block, F., Dewald, A., 2019. Windows memory forensics: Detecting (un)intentionally hidden injected code by examining page table entries. Digital Investigation 29, S3– S12. https://doi.org/10.1016/j.diin.2019.04.008.

Hendrickx, K., Perini, L., Van der Plas, D., Meert, W., Davis, J., 2024. Machine learning with a reject option: A survey. Machine Learning 113, 3073–3110. https://doi. org/10.1007/s10994-024-06534-x.

Bollé, T., Casey, E., Jacquet, M., 2020. The role of evaluations in reaching decisions using automated systems supporting forensic analysis. Forensic Science International: Digital Investigation 34, 301016. https://doi.org/10.1016/j.fsidi.2020.301016.

Horsman, G., 2019. Tool testing and reliability issues in the field of digital forensics. Digital Investigation 28, 163–175. https://doi.org/10.1016/j.diin.2019.01. 009.

Bozkir, A.S., Tahillioglu, E., Aydos, M., Kara, I., 2021. Catch them alive: A malware detection approach through memory forensics, manifold learning and computer vision. Computers & Security 103, 102166. https://doi.org/10.1016/j.cose.2020. 102166.

Hu, W., Liu, B., Gomes, J., Zitnik, M., Liang, P., Pande, V., Leskovec, J., 2020. Strategies for pre-training graph neural networks, in: 8th International Conference on Learning Representations (ICLR). https://openreview.net/forum?id=HJlWWJSFDH.

Breitinger, F., Jotterand, A., 2023. Sharing datasets for digital forensic: A novel taxonomy and legal concerns. Forensic Science International: Digital Investigation 45, 301562. https://doi.org/10.1016/j.fsidi.2023.301562.

Jin, W., Li, Y., Xu, H., Wang, Y., Ji, S., Aggarwal, C., Tang, J., 2021. Adversarial attacks and defenses on graphs: A review, a tool and empirical studies. ACM SIGKDD Explorations Newsletter 22, 19–34. https://doi.org/10.1145/3447556.3447566.

Carrier, T., Victor, P., Tekeoglu, A., Lashkari, A.H., 2022. Detecting obfuscated malware using memory feature engineering, in: Proceedings of the 8th International Conference on Information Systems Security and Privacy (ICISSP), SciTePress. pp. 177–188. https://doi.org/10.5220/0010908200003120.

Joyce, R.J., Amlani, D., Nicholas, C., Raff, E., 2023. MOTIF: A malware reference dataset with ground truth family labels. Computers & Security 124, 102921. https://doi. org/10.1016/j.cose.2022.102921.

Case, A., Jalalzai, M.M., Firoz-Ul-Amin, M., Maggio, R.D., Ali-Gombe, A., Sun, M., Richard, III, G.G., 2019. HookTracer: A system for automated and accessible API hooks analysis. Digital Investigation 29, S104–S112. https://doi.org/10.1016/ j.diin.2019.04.011.

Kapoor, S., Narayanan, A., 2023. Leakage and the reproducibility crisis in machinelearning-based science. Patterns 4, 100804. https://doi.org/10.1016/j. patter.2023.100804. Lakshminarayanan, B., Pritzel, A., Blundell, C., 2017. Simple and scalable predictive uncertainty estimation using deep ensembles, in: Advances in Neural Information Processing Systems 30, pp. 6402–6413. https://proceedings.neurips.cc/paper/ 2017/hash/9ef2ed4b7fd2c810847ffa5fa85bce38-Abstract.html.

Case, A., Richard, III, G.G., 2017. Memory forensics: The path forward. Digital Investigation 20, 23–33. https://doi.org/10.1016/j.diin.2016.12.004. Casey, E., 2020. Standardization of forming and expressing preliminary evaluative opinions on digital evidence. Forensic Science International: Digital Investigation 32, 200888. https://doi.org/10.1016/j.fsidi.2019.200888.

Lashkari, A.H., Li, B., Carrier, T.L., Kaur, G., 2021. VolMemLyzer: Volatile memory analyzer for malware classification using feature engineering, in: 2021 Reconciling Data Analytics, Automation, Privacy, and Security: A Big Data Challenge (RDAAPS), IEEE. pp. 1–8. https://doi.org/10.1109/RDAAPS48126.2021.9452028.

Clopper, C.J., Pearson, E.S., 1934. The use of confidence or fiducial limits illustrated in the case of the binomial. Biometrika 26, 404–413. https://doi.org/10.1093/ biomet/26.4.404.

Ligh, M.H., Case, A., Levy, J., Walters, A., 2014. The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory. Wiley, Indianapolis, IN. ISBN 978-1-118-82509-9.

Dehfouli, Y., Habibi Lashkari, A., 2026. Memory analysis for malware detection: A comprehensive survey using the OSCAR methodology. ACM Computing Surveys 58, 86:1– 86:58. https://doi.org/10.1145/3764580.

Ojala, M., Garriga, G.C., 2010. Permutation tests for studying classifier performance. Journal of Machine Learning Research 11, 1833–1863. https://jmlr.org/papers/ v11/ojala10a.html.

Dener, M., Ok, G., Orman, A., 2022. Malware detection using memory analysis data in big data environment. Applied Sciences 12, 8604. https://doi.org/10.3390/ app12178604.

Or-Meir, O., Nissim, N., Elovici, Y., Rokach, L., 2019. Dynamic malware analysis in the modern era – a state of the art survey. ACM Computing Surveys 52, 88:1–88:48. https://doi.org/10.1145/3329786.

Dunsin, D., Ghanem, M.C., Almeida Palmieri, E., Kheddar, H., Habchi, Y., 2025a. MalVol-25: A diverse, labelled and detailed volatile memory dataset for malware detection and response testing and validation, in: 2025 8th Conference on Cloud and Internet of Things (CIoT), IEEE, London, UK. pp. 1–5. https://doi.org/10.1109/ CIoT67574.2025.11410149.

Ottmann, J., Breitinger, F., Freiling, F., 2024. An experimental assessment of inconsistencies in memory forensics. ACM Transactions on Privacy and Security 27, 2:1–2:29. https://doi.org/10.1145/3628600.

Dunsin, D., Ghanem, M.C., Almeida Palmieri, E., Kheddar, H., Habchi, Y., Alemayehu, M., 2025b. MalVol-25: A diverse, labeled and detailed malware volatile memory dataset for detection and response testing and validation. IEEE DataPort. https: //doi.org/10.21227/kg5b-nf37.

Pagani, F., Fedorov, O., Balzarotti, D., 2019. Introducing the temporal dimension to memory forensics. ACM Transactions on Privacy and Security 22, 9:1–9:21. https: //doi.org/10.1145/3310355.

20

Ruff, L., Kauffmann, J.R., Vandermeulen, R.A., Montavon, G., Samek, W., Kloft, M., Dietterich, T.G., Müller, K.R., 2021. A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE 109, 756–795. https://doi.org/10.1109/ JPROC.2021.3052449. Rzepka, L., Ottmann, J., Freiling, F., Baier, H., 2024. Causal inconsistencies are normal in Windows memory dumps (too). Digital Threats: Research and Practice 5, 31:1–31:20. https://doi.org/10.1145/3680293. Rzepka, L., Ottmann, J., Stoykova, R., Freiling, F., Baier, H., 2025. A scenario-based quality assessment of memory acquisition tools and its investigative implications. Forensic Science International: Digital Investigation 52, 301868. https://doi.org/10. 1016/j.fsidi.2025.301868. Sihwail, R., Omar, K., Ariffin, K.A.Z., 2021. An effective memory analysis for malware detection and classification. Computers, Materials & Continua 67, 2301–2320. https: //doi.org/10.32604/cmc.2021.014510. Silva Filho, T., Song, H., Perello-Nieto, M., Santos-Rodriguez, R., Kull, M., Flach, P., 2023. Classifier calibration: A survey on how to assess and improve predicted class probabilities. Machine Learning 112, 3211–3260. https://doi.org/10.1007/ s10994-023-06336-7. Song, W., Yin, H., Liu, C., Song, D., 2018. DeepMem: Learning graph neural network models for fast and robust memory forensic analysis, in: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, ACM. pp. 606–618. https://doi.org/10.1145/3243734.3243813. Volatility Foundation, 2026. Volatility 3 framework. https://github.com/ volatilityfoundation/volatility3. Accessed 28 May 2026. Xu, K., Hu, W., Leskovec, J., Jegelka, S., 2019. How powerful are graph neural networks?, in: 7th International Conference on Learning Representations (ICLR). https: //openreview.net/forum?id=ryGs6iA5Km.

21

Related documents

• Dissecting Agentic Forensics: The Role of Triage, Prompting, and Evidence Arbitration in Open-World Fake Image Detection#1050538
• Dissecting Agentic Forensics: The Role of Triage, Prompting, and Evidence Arbitration in Open-World Fake Image Detection#1028592
• When Benign Is Unverified: Label-Signal Mismatch and Abstention-First Triage in Graph-Based Memory Forensics#1537032
• Beyond Generation: Using Multimodal LLMs as Detectors of LLM-Generated Deepfake Facial Images#1357415
• Automated Inference of Graph Transformation Rules#622689