MAIR-Suite: An Automated Multi-Vector Malware Analysis, Threat Classification, and Incident Response Framework
Keywords:
Digital forensics, Incident response, Indicators of compromise, Malware analysis, Memory forensics, MITRE ATT&CK, Random ForestAbstract
Malware investigation often requires evidence from several sources, including file characteristics, signature matches, runtime behavior, and volatile memory, yet these findings are commonly produced by separate tools and are difficult to correlate. This paper proposes MAIR-Suite, an automated multi-vector malware analysis, threat classification, and incident response framework that integrates static analysis, YARA scanning, controlled dynamic behavior analysis, and Volatility 3-based memory forensics in a single workflow. Findings are normalized and correlated as indicators of compromise, including hashes, URLs, IP addresses, process information, and memory artifacts, and are then passed to a threat-scoring stage and a proposed Random Forest classifier that categorizes samples as BENIGN, SUSPICIOUS, or MALICIOUS. Observed activities are mapped to MITRE ATT&CK techniques to provide a standardized interpretation of behavior, and structured HTML and PDF incident reports are generated for investigator review. The paper presents the problem statement, literature review, methodology, system architecture, and evaluation plan for the proposed design. As the work describes a proposed system rather than a completed implementation, no experimental accuracy or performance results are claimed.
References
M. Sikorski and A. Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. San Francisco, CA, USA: No Starch Press, Feb. 2012.
Volatility Foundation, Volatility 3 Documentation, release 2.28.2. Volatility Foundation.
YARA Project, YARA Documentation: The Pattern Matching Swiss Army Knife for Malware Researchers, release 4.5.0.
M. H. Ligh, A. Case, J. Levy, and A. Walters, The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory. Indianapolis, IN, USA: Wiley, Jul. 2014.
P. Cichonski, T. Millar, T. Grance, and K. Scarfone, Computer Security Incident Handling Guide, NIST Special Publication 800-61, Rev. 2. Gaithersburg, MD, USA: National Institute of Standards and Technology, Aug. 2012.
K. Kent, S. Chevalier, T. Grance, and H. Dang, Guide to Integrating Forensic Techniques into Incident Response, NIST Special Publication 800-86. Gaithersburg, MD, USA: National Institute of Standards and Technology, Aug. 2006.
K. Mandia, C. Prosise, and M. Pepe, Incident Response and Computer Forensics, 2nd ed. New York, NY, USA: McGraw-Hill/Osborne, Jul. 2003.
E. Casey, Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet, 3rd ed. Waltham, MA, USA: Academic Press, 2011.
L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, Oct. 2001.
MITRE Corporation, MITRE ATT&CK Enterprise. McLean, VA, USA: MITRE Corp.
