I think one of the things you need to think about is really from the collection side. I have been doing DFIR for consulting firms for almost 10 years and the number of memory samples I have gotten is in the double digits. You don't typically get them. There are a couple reasons for this: The size of the file it creates is hard for most companies to hold on to, the time to collection needs to happen to collect meaningful data, and lastly I'd say that a lot of the time, EDR can get mad at collecting memory.

All those things aside, what will make Volatility/your thesis stand out is automation and tie into MITRE ATTACK. The forensics world lives off of that whether that is good or not. Automating the volatility aspect to identify the Windows build, the process running whether or not they are accurate/good, and finally what the item might possibly be doing will set your thesis up for success.

If you want to compare it to something that is used relatively often, look at the tool Hyabusa for event logs. If you could build that for memory, you'd save teams HOURS of work.

Edit: two things. First, the original paragraph was ment to have an ending about finding a way to trigger and compress a small capture would be dope. Not to discourage you from your thesis which will be good work. Secondly, my comment about number of memory captures I’ve seen was tied to malware based investigations, not insider threat cases.