EGAMA-MF: Evidence-Integrity Gating for Memory-Forensic Malware Triage
This paper introduces EGAMA-MF, a middleware framework that enhances memory-forensic malware triage by gating out structurally valid but forensically inadmissible feature vectors caused by extraction failures, thereby preventing false negatives and ensuring evidence integrity across diverse fault scenarios.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the high-stakes world of digital forensics, investigators often rely on automated tools to sift through the chaotic aftermath of a cyberattack. When a computer is compromised, its memory holds the most immediate and volatile clues: running programs, hidden connections, and injected code that file-based scans might miss. To make sense of this data, researchers use specialized software to extract specific indicators, turning raw memory into structured lists of numbers that machine learning models can analyze. The goal is to quickly decide if a system is safe or if it requires a human expert's attention. However, a critical flaw exists in this process: if the extraction tool fails to find a specific piece of evidence, the system might simply record a zero. To a computer, a zero usually means "nothing was found," but in reality, it could mean "the tool failed to look." This ambiguity creates a dangerous blind spot where missing information is mistaken for confirmed absence, potentially allowing a compromised system to slip through the cracks.
A researcher at the University of Cincinnati has addressed this vulnerability with a new system called EGAMA-MF, which acts as a strict gatekeeper before any automated decision is made. Instead of trusting the numbers alone, this system checks the story behind the numbers. It verifies that every required piece of evidence was successfully extracted, that the software tools used to find them finished their work without error, and that the data comes from a verified source. If any part of this chain is broken, the system blocks the case from being automatically accepted, forcing it to be reviewed by a human analyst. This approach treats the integrity of the evidence itself as a separate, non-negotiable condition, distinct from the prediction of whether the system is infected.
The researcher tested this gatekeeper using a massive dataset of over eleven thousand known computer cases, which they had previously prepared for analysis. To simulate real-world failures, they deliberately broke the data in one hundred and seven different ways. They corrupted the extraction status, simulated software crashes, and introduced missing fields, creating more than a million faulty versions of the data. They then ran these faulty inputs through their new system and compared the results against a simpler system that only checked if the numbers looked correct. The results were stark. The new evidence-gating system caught every single one of the one million, one hundred and forty thousand, eight hundred and forty faulty inputs, stopping them before they could reach the decision-making stage. In contrast, the simpler system, which only checked the shape of the data, let over three hundred thousand of these broken inputs pass through because the numbers themselves still looked valid.
The study also examined how this gatekeeper performs in a real-world scenario using a known case from the Digital Corpora, a collection of forensic images. In this specific instance, the software used to extract memory data failed to retrieve two critical components due to a deep technical error. Because the new system noticed these missing pieces, it immediately halted the automated process and routed the case for human review. This prevented the system from making a confident prediction based on incomplete information. The researcher found that without this gate, nearly forty percent of the cases in their test set would have been automatically accepted, even though the evidence for them was flawed. By enforcing this check, the system ensures that automation only happens when the evidence is complete and trustworthy.
Beyond just catching errors, the researcher explored how changing the rules for acceptance affects safety. They tested different settings to see how many cases could be safely automated versus how many needed human review. They found that they could increase the number of automatically accepted cases from about thirty-two percent to nearly thirty-eight percent without seeing any errors in the accepted group. However, pushing the acceptance rate higher to forty percent introduced mistakes, showing that there is a limit to how much automation can be trusted without increasing risk. The system proved to be incredibly fast, taking only a fraction of a millisecond to check each case, meaning it adds almost no delay to the investigation process.
This work does not replace the machine learning models that detect malware, nor does it replace the human experts who analyze complex cases. Instead, it sits between the data extraction and the decision-making, acting as a quality control filter. It ensures that the models only work with evidence that is known to be complete and that the models do not have to guess whether a zero means "safe" or "broken." By separating the question of "is the evidence valid?" from "what does the evidence say?", the researcher has created a more reliable foundation for digital forensics. The findings suggest that while automation is powerful, it must be paired with rigorous checks on the quality of the data it receives to prevent silent failures that could compromise security.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.