Abstract:Run-time behavior of processes – running on an end-host – is being actively used to dynamically detect malware. Most of these detection schemes build model of run-time behavior of a process on the basis of its data flow and/or sequence of system calls. These novel techniques have shown promising results but an efficient and effective technique must meet the following performance metrics: (1) high detection accuracy, (2) low false alarm rate, (3) small detection time, and (4) the technique should be resilient to run-time evasion attempts.To meet these challenges, a novel concept of genetic footprint is proposed, by mining the information in the kernel process control blocks (PCB) of a process, that can be used to detect malicious processes at run time. The genetic footprint consists of selected parameters – maintained inside the PCB of a kernel for each running process – that define the semantics and behavior of an executing process. A systematic forensic study of the execution traces of benign and malware processes is performed to identify discriminatory parameters of a PCB (task_struct is PCB in case of Linux OS). As a result, 16 out of 118 task structure parameters are short listed using the time series analysis. A statistical analysis is done to corroborate the features of the genetic footprint and to select suitable machine learning classifiers to detect malware.The scheme has been evaluated on a dataset that consists of 105 benign processes and 114 recently collected malware processes for Linux. The results of experiments show that the presented scheme achieves a detection accuracy of 96% with 0% false alarm rate in less than 100ms of the start of a malicious activity. Last but not least, the presented technique utilizes partial knowledge that is available at a given time while the process is still executing; as a result, the kernel of OS can devise mitigation strategies. It is also shown that the presented technique is robust to well known run-time evasion attempts.

The Detection of Hidden Process Technology Based on Thread Scheduling

Vmpmonitor: an Efficient Modularity Approach for Hidden Process Detection

Defense of Hidden Backdoor Technology for Web

A Hidden Process Detection Model Based on System Management Mode

Hidden Process Detection Based on Structural Relationship Retrieval

Latent and Small Fault Detection and Diagnosis for Dynamic Processes

A method for hidden malcode anomaly detection using dynamic control-flow analysis

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Windows 7 SP1 for DKOM Under the Attack Technology Research

Plagiarism detection for multithreaded software based on thread-aware software birthmarks.

HODetector: the Hidden Objects Detection Based on Static Semantic Information Library Outside Virtual Machine

Detective: Automatically Identify and Analyze Malware Processes in Forensic Scenarios Via DLLs

Tell you a Definite Answer: Whether Your Data is Tainted During Thread Scheduling

In-execution dynamic malware analysis and detection by mining information in process control blocks of Linux OS

A Static Method for Detection of Information Theft Malware

An Implementation of Windows System Call Interception Used For Access Control

Research on Process Hiding Technology Based on Direct Kernel Object Manipulation

Implicit-Flow-Sensitive Method for Detection of Trojan-Spy Programs

Malicious behavior monitoring technology based on Windows Service

Behavior-Based Proactive Detection of Unknown Malicious Codes

Technology of Hidden Process Rootkit on Win32