Detecting Fileless Malware through Memory Forensics with Recurrent Neural Networks

May 11, 2026

Upload by Patrick

Fileless malware executes solely in volatile memory, using legitimate system utilities to avoid signature-based and static analysis defenses. This work introduces a detection framework that combines memory forensics with recurrent neural networks to model temporal dependencies that traditional approaches miss. Forensic and behavioral features extracted from memory capture transient process activity, memory-resident module behavior, and short-lived network interactions. Experiments compare multiple RNN architectures and show Bidirectional LSTM delivers the strongest results, with accuracy 0.93 and recall 1.00, highlighting behavioral memory indicators as reliable for in-memory threat detection.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages6

Reading Time15 min

May 11, 2026

Upload by Patrick