Abstract:Integrity protection has proven an effective way of malware detection and defense. Determining the integrity of subjects programs and objects files and registries plays a fundamental role in integrity protection. However, the large numbers of subjects and objects, and intricate behaviors place burdens on revealing their integrities either manually or by a set of rules. In this paper, we propose a probabilistic model of integrity in modern operating system. Our model builds on two primary security policies, \"no read down\" and \"no write up\", which make connections between observed access behaviors and the inherent integrity ordering between pairs of subjects and objects. We employ a message passing based inference to determine the integrity of subjects and objects under a probabilistic graphical model. Furthermore, by leveraging a statistical classifier, we build an integrity based access behavior model for malware detection. Extensive experimental results on a real-world dataset demonstrate that our model is capable of detecting 7,257 malware samples from 27,840 benign processes at 99.88ï¾¿% true positive rate under 0.1ï¾¿% false positive rate. These results indicate the feasibility of our probabilistic integrity model.

An Integrity Control Model for Operating System

Research on Information Security Model and Security System Design

Secguard: Secure And Practical Integrity Protection Model For Operating Systems

Handling Dynamic Information Release

Design of Secure Operating System

Dynamic Security Access Control Model Based on System Reliability

Dynamically modified union model combining confidentiality and integrity

Hybrid Mandatory Model Composed of BLP and Clark-Wilson Policy

Research on Microkernel Integrity Semantics Model and Formal Verification

OSISS: An operating system integrity surveillance system based on VMM

Screening Decentralized Control Structure for Integrity Based on Branch and Bound Method

Generalized Taint Propagation Model for Access Control in Operation Systems

Formal Modeling and Security Analysis for Intra-level Privilege Separation.

Business Activity-Oriented Security Model of Information Systems

Integrity Assurance of Micro-kernel Operating System and Its Application

A Privacy Protection Model for Transparent Computing System.

Integrity Constraints in Trust Management

Inconsistency Management of Role Base Access Control Policy

A Compositional Multiple Policies Operating System Security Model

Probabilistic Inference on Integrity for Access Behavior Based Malware Detection.

An Access Control Model for Trustworthy Network