BitProbe: A Unified Tool for Automated Malware Analysis and Live Forensic Triage on Windows
Year: 2026
Type: article
Abstract: Modern enterprise security operations face a deepening asymmetry: the average cost of a data breach reached approximately USD 4.44 million globally in 2025, while the mean time to identify and contain incidents hovered near 241 days. This paper presents BitProbe, a Windows-first orchestration framework that chains industry-standard forensic utilities into a single, privilege-aware automated pipeline. BitProbe integrates pefile, yara-python, Ghidra headless, Sysinternals ProcMon and TCPView, TShark (≈60s packet capture), WinPMEM memory acquisition, volatility3 plugin chains, and scapy for network traffic dissection. A compile_master_report() function aggregates all structured JSON artifacts into a single formatted forensic report, packaged as a standalone .exe via PyInstaller. Experimental evaluation against five malware families — WannaCry, Emotet, TrickBot, a generic password stealer, and Mirai — demonstrates a 95.1% average reduction in total analysis time, a 94% YARA detection rate, and an 87% IOC recall rate against published ground-truth threat intelligence.
Institution: Ajeenkya DY Patil University
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7153638849
FWCI:
Cites:
Cited by:
Related to: