DFIR-Chain - Integrating Memory Forensics, YARA Scanning, and LLM Summarization for Automated Triage

Abstract

Digital forensics and incident response (DFIR) must evolve to deal with increasingly complex memory-resident threats and the ever-increasing volume of volatile data. In response, DFIR-Chain is introduced, an integrated toolchain that brings together traditional memory forensics (Volatility 3), signature scans (YARA and IOC matching), string extraction, and large language model (LLM) Summarization (via LangChain and an Ollama-served Mistral model) to automate the triage of compromised systems. DFIR-Chain produces visual process trees, a timeline of events (using Graphviz), and a narrative report of findings. The system is evaluated using an accurate memory snapshot from a publicly available capture-the-flag (CTF) image, and show how each DFIR component contributes to the highfidelity detection of malware. Preliminary ablation study shows that removing even one of the components, such as YARA or LLM summarization, leads to a drop of as much as <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{1 0}$</tex> percent in the F1 score. This work displays how LLM techniques combined with expert signatures offer possibilities to create AI-supported reports with higher reliability than automated approaches. This work also considers how DFIR-Chain factors into the picture as a counterpart against traditional and most recently developed machine learning-based DFIR tools and automated triage systems, and our use of LLMs for forensic report narratives is one way this effort reaches beyond the community to understand better how memory forensics can meet incident response needs. DFIRChain represents an improved method for providing investigatory accuracy and efficiency and shows a non-therapeutic approach forward in the form of memory forensics for incident response.

Topics & Concepts