Interpreting Cyber-Threat Indicators in Enterprise Memory Forensics: A Mixed-Methods Study of Machine Learning Performance and Explainability

Abstract

This study examines the interpretation of cyber-threat indicators in enterprise memory-forensic environments by integrating machine-learning performance, forensic evidence quality, explainable artificial intelligence, and analyst decision support within a unified empirical framework. The research addresses the problem that enterprise investigators must interpret large volumes of volatile-memory evidence containing processes, modules, network connections, privileges, injected regions, and other runtime artifacts, while conventional manual procedures and opaque machine-learning classifications may not provide sufficiently transparent, efficient, or defensible threat assessments. The purpose of the study is to determine the individual and combined effects of Machine Learning Threat Detection Capability, Memory Forensic Indicator Identification Effectiveness, Explainable AI Interpretability Quality, and Analyst Decision-Support Capability on Cyber-Threat Interpretation Performance. A quantitative, cross-sectional, case-study-based research design was applied across selected enterprise cybersecurity, digital-forensic, security-operations, incident-response, and threat-analysis cases, including financial services, technology and cloud-service environments, government and critical infrastructure, telecommunications, and other enterprise settings. The purposive sample comprised cybersecurity and SOC analysts, digital-forensic investigators, malware analysts, incident-response professionals, threat-intelligence specialists, security engineers, and related practitioners. Of 320 questionnaires distributed, 301 were returned and 289 valid responses were retained, yielding a usable response rate of 90.3%. Reliability was strong, with Cronbach's alpha values ranging from .85 to .91, KMO = .892, and Bartlett's Test p < .001. CTIP recorded M = 4.21, SD = 0.51. MFIIE demonstrated the strongest correlation with CTIP, r = .76, followed by XAIQ, r = .72, ADSC, r = .70, and MLTDC, r = .68, all p < .001. The regression model explained 71.4% of CTIP variance, R² = .714, adjusted R² = .710, F (4,284) = 177.25, p < .001. MFIIE emerged as the strongest predictor, β = .32, followed by XAIQ, β = .28, ADSC, β = .23, and MLTDC, β = .19. The findings support H1 through H4 and imply that effective enterprise cyber-threat interpretation depends on the coordinated integration of accurate machine-learning detection, reliable memory-forensic evidence identification, understandable AI explanations, and analyst-centered decision support.