← Back to project catalogue
GP-CY-12TEBKKCybersecurityReady

Memory-forensics Timeline Correlation Laboratory

An offline Python laboratory that combines selected Volatility 3 process, memory, network, and registry exports into one explainable incident timeline.

Memory-forensics Timeline Correlation Laboratory project visual
GP-CY-12TEBKK · Cybersecurity
  • Python 3.11
  • Volatility 3 JSONL
  • pandas
  • NumPy
  • Matplotlib

Project definition

Problem statement

A memory investigation can produce separate process, scan, network, executable-memory, and registry records. Reading each source alone can hide the relationship between events.

This project normalises selected Volatility 3 JSONL exports, links related records by process and time, and retains the source evidence behind each finding.

Project objectives

  • Import selected pslist, psscan, netscan, malfind, and printkey JSONL records.
  • Normalise source fields into a consistent event schema without changing the original files.
  • Build a time-ordered case timeline with process and evidence links.
  • Apply six explainable rules for hidden processes, executable private memory, network activity, orphaned owners, autorun links, and suspicious parent-child relationships.
  • Measure finding accuracy, evidence recovery, timeline order, and the effect of incomplete or noisy acquisition.
  • Reproduce the complete controlled experiment from the command line.

Project structure

Project components

01

Volatility adapters

Convert five selected plugin exports into a common event structure.

02

Timeline builder

Orders normalised records and preserves process, timestamp, plugin, and source-file evidence.

03

Correlation engine

Links related records within a configurable time window and applies six explicit rules.

04

Case generator

Creates 12 safe synthetic plugin-style case bundles with independent truth labels.

05

Benchmark runner

Tests complete, noisy, partial, and time-skewed inputs across three correlation windows.

06

Evidence outputs

Writes JSON results, CSV trials, seven labelled figures, and an offline dashboard.

Methodology

Project workflow

  1. 01
    Prepare exports

    Use an included case or export the selected Volatility 3 plugin results as JSONL.

  2. 02
    Import events

    The adapters validate and normalise process, memory, network, and registry records.

  3. 03
    Correlate evidence

    Events are linked by process identity, relationship, and the selected time window.

  4. 04
    Review findings

    Each finding shows its rule, severity, explanation, event order, and supporting sources.

  5. 05
    Reproduce results

    The benchmark command rebuilds all 144 trials, metrics, figures, and dashboard.

Demonstration scenario

A prepared case contains a process omitted from pslist but present in psscan, an executable private-memory region, a network connection, and an autorun registry record. The analyser joins the sources into one ordered explanation and retains every supporting record.

Engineering

Tools and method

Core package
Typed Python modules for schemas, input adapters, correlation, metrics, scenarios, experiments, and commands.
Evidence model
A small event schema retains source plugin, time, process identifiers, attributes, and traceable record references.
Controlled experiment
Twelve deterministic cases are evaluated under four acquisition conditions and three time windows.
Quality controls
32 tests, 98.22 percent combined coverage, Ruff checks, dependency audit, repository validation, and document accessibility audits.

Testing

Evaluation

Evaluation measures

  • Finding precision, recall, and F1 for each acquisition condition
  • Recovery of the expected supporting evidence
  • Timeline-order accuracy under source clock skew
  • Comparison of 60, 180, and 300 second correlation windows
  • Complete-capture and incident-case performance
  • Automated tests, combined statement and branch coverage, and retained trial evidence

Project boundaries

  • The included cases are controlled synthetic Volatility-style exports. They are not real memory images.
  • Raw memory acquisition and direct memory-image parsing are outside this project.
  • A correlation finding is not a malware verdict, attribution, or legal conclusion.
  • Real evidence requires authorised acquisition, integrity controls, tool validation, and qualified review.
  • No information is collected.

Included

  1. 01Complete Python source code and command-line tools
  2. 02Five selected Volatility 3 JSONL adapters
  3. 0312 controlled case bundles and 144 retained benchmark trials
  4. 04Seven result figures and a self-contained results dashboard
  5. 0532 automated tests with 98.22 percent combined statement and branch coverage
  6. 0697-page project report in PDF and editable Word formats
  7. 0721-page setup and usage guide in PDF and editable Word formats
  8. 0845 annotated references

Project record

No information is collected on this page.

Permanent project ID
GP-CY-12TEBKK
Catalogued
21 Aug 2026
Completed
24 Aug 2026
Verified
24 Aug 2026
Demonstration
Included in repository

Handover

After purchase

  1. 01
    Payment is confirmed

    The project is marked unavailable and cannot be purchased again.

  2. 02
    Repository access is granted

    The buyer's submitted GitHub account receives access to the private repository.

  3. 03
    The purchase record is delivered

    The certification sheet is prepared from the reviewed buyer details and sent privately by email.