Abstract:As computing systems become increasingly advanced and as users increasingly engage themselves in technology, security has never been a greater concern. In malware detection, static analysis, the method of analyzing potentially malicious files, has been the prominent approach. This approach, however, quickly falls short as malicious programs become more advanced and adopt the capabilities of obfuscating its binaries to execute the same malicious functions, making static analysis extremely difficult for newer variants. The approach assessed in this paper is a novel dynamic malware analysis method, which may generalize better than static analysis to newer variants. Inspired by recent successes in Natural Language Processing (NLP), widely used document classification techniques were assessed in detecting malware by doing such analysis on system calls, which contain useful information about the operation of a program as requests that the program makes of the kernel. Features considered are extracted from system call traces of benign and malicious programs, and the task to classify these traces is treated as a binary document classification task of system call traces. The system call traces were processed to remove the parameters to only leave the system call function names. The features were grouped into various n-grams and weighted with Term Frequency-Inverse Document Frequency. This paper shows that Linear Support Vector Machines (SVM) optimized by Stochastic Gradient Descent and the traditional Coordinate Descent on the Wolfe Dual form of the SVM are effective in this approach, achieving a highest of 96% accuracy with 95% recall score. Additional contributions include the identification of significant system call sequences that could be avenues for further research.

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

Dynamical System approach to insider threat detection

An Intrusion Detection System Based On System Call

F-DDIA: A Framework for Detecting Data Injection Attacks in Nonlinear Cyber-Physical Systems.

An Active Detection Strategy Based on Dimensionality Reduction for False Data Injection Attacks in Cyber-Physical Systems

Malicious Code Execution Detection and Response Immune System inspired by the Danger Theory

Detecting Privilege Escalation Attacks through Instrumenting Web Application Source Code.

Dynamic Neural Control Flow Execution: An Agent-Based Deep Equilibrium Approach for Binary Vulnerability Detection

Malicious Source Code Detection Using Transformer

Dynamic Analysis of Malicious Code

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

A malware detection framework based on kolmogorov complexity

Analyzing and Improving Performance of a Class of Anomaly-based Intrusion Detectors

A Novel Control-flow based Intrusion Detection Technique for Big Data Systems

Detection of Hidden Attacks on Cyber-Physical Systems from Serial Magnitude and Sign Randomness Inconsistencies

Rampo: A CEGAR-based Integration of Binary Code Analysis and System Falsification for Cyber-Kinetic Vulnerability Detection

Applying Bag of System Calls for Anomalous Behavior Detection of Applications in Linux Containers

No Need to Know Physics: Resilience of Process-based Model-free Anomaly Detection for Industrial Control Systems

Anomaly-Based Intrusion Detection System for Cyber-Physical System Security

NtMalDetect: A Machine Learning Approach to Malware Detection Using Native API System Calls