{
  "abstract": "Cyber-forensic investigations increasingly involve heterogeneous evidence, including phishing audio, malicious text and scripts, executable binaries, memory artifacts, and network traffic. Existing approaches generally analyze these sources independently or perform sample-level fusion without explicitly addressing temporal asynchrony, higher-order forensic relationships, missing attack stages, counterfactual threat evolution, and attribution uncertainty. This paper presents a Multimodal Generative Cyber Forensics Network comprising CTEEN for temporal-semantic alignment, NSFRH for higher-order forensic reasoning, GASRE for evidence-constrained attack-stage reconstruction, CMES for counterfactual malware-evolution analysis, and CTAECO for confidence-aware candidate-category attribution. The evaluation used VirusShare, CIC-MalMem-2022, the Android Malware Corpus, the Malware Traffic Repository, and an Integrated Controlled Multimodal Benchmark constructed from source pools containing approximately 52,000 malware records, 1.8 million network-flow records, 24,000 textual or script artifacts, and 12,500 phishing or social-engineering audio recordings. Comparisons were conducted against Cyber Code Intelligence, AI-Based Malware Analysis, Multimodal Pre-trained Fusion, and LLM-MalDetect using identical eligible evidence groups, preprocessing outputs, partitions, and metric definitions. Across 25 matched partition–seed observations, the proposed framework achieved 99.26 ± 0.18% classification accuracy (95% CI: 99.19–99.33%), 99.20 ± 0.21% F1-score, and 99.66 ± 0.12% AUC. It further obtained 98.46% mean controlled alignment accuracy, 98.68% evidence-constrained reconstruction accuracy, 99.04% benchmark-defined candidate-category attribution accuracy, and 99.0% overall forensic-intelligence reliability. Accuracy decreased to 95.18% under temporally disjoint testing and 92.34% under family-disjoint testing. Leakage audits, negative controls, matched statistical tests, and alternative-design ablations further supported the findings. The complete framework contained 96.3 million trainable parameters and required 12.8 GB of peak memory, with a mean inference latency of 73.2 ms per complete multimodal episode (13.7 episodes/s) under the reported computational environment. These requirements indicate that deployment on resource-constrained platforms would require model compression or inference optimization. Reviewer 3, Comment 3) The results demonstrate effective evidence-constrained multimodal reasoning under the controlled benchmark but do not establish natural incident-level correspondence, definitive real-world attribution, or universal forensic performance.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": null,
  "author_total": 5,
  "authors": [
    {
      "name": "Rijvan Beg"
    },
    {
      "name": "R. K. Pateriya"
    },
    {
      "name": "Deepak Singh Tomar"
    },
    {
      "name": "Ghanshyam Raghuwanshi"
    },
    {
      "name": "Surendra Solanki"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/173h57xqspf9q.bib",
  "cited_by": 0,
  "doi": "10.1038/s41598-026-69869-6",
  "fulltext_url": null,
  "id": "173h57xqspf9q",
  "issns": [
    "2045-2322"
  ],
  "landing_url": "https://www.nature.com/articles/s41598-026-69869-6",
  "language": null,
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "https://creativecommons.org/licenses/by/4.0",
  "metadata_licence": null,
  "native_subjects": [
    [
      "openalex",
      "1711|Advanced Malware Detection Techniques"
    ]
  ],
  "openalex": "W7220430479",
  "pdf_url": "https://www.nature.com/articles/s41598-026-69869-6_reference.pdf",
  "pmcid": null,
  "pmid": null,
  "published": "2026-10-05",
  "publisher": "Springer Science and Business Media LLC",
  "ris": "https://research.draconitic.com/paper/173h57xqspf9q.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:17:22Z",
      "native_id": "10.1038/s41598-026-69869-6",
      "source": "crossref",
      "url": "https://www.nature.com/articles/s41598-026-69869-6"
    }
  ],
  "subjects": [],
  "title": "Multimodal generative cyber forensics network for unified malware intelligence synthesis through temporal evidence alignment, neuro-symbolic hypergraph reasoning, and cognitive threat attributions",
  "title_text": "Multimodal generative cyber forensics network for unified malware intelligence synthesis through temporal evidence alignment, neuro-symbolic hypergraph reasoning, and cognitive threat attributions",
  "type": "peer-reviewed",
  "updated_at": "2026-10-30T12:17:22Z",
  "url": "https://research.draconitic.com/paper/173h57xqspf9q",
  "venue": "Scientific Reports",
  "versions": []
}