Temporal reconstruction of process semantics from sequential memory dumps using large language models

Résumé fourni par la source

This paper presents a forensic investigation framework for reconstructing the evolving semantic state of running processes from sequential memory dumps. Instead of analyzing memory images as isolated evidence, the proposed method correlates artifacts across successive dumps to infer process creation, evolution, interaction, and termination events. The framework follows a five-phase workflow: system-wide artifact extraction, process-specific artifact extraction, profile construction and correlation, difference-profile generation, and AI-assisted semantic analysis. A large language model is used as a reasoning layer to interpret structured temporal differences, align observations across time, and generate higher-level explanations of process behavior. The framework is evaluated in a controlled Windows 11 virtual environment mainly using a staged benign process. The results show that multi-snapshot analysis produces more complete and accurate semantic reconstructions than single-dump analysis. In the staged execution scenario, temporal reasoning reconstructed all behavioral transitions, while single-snapshot interpretation missed key stage boundaries and transition events. These findings show that temporal differencing reduces interpretive ambiguity and improves semantic clarity in memory-based investigations.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.