Abstract:To subvert recent advances in perimeter and host security, the attacker community has developed and employed various attack vectors to make a malware much stealthier than before to penetrate the target system and prolong its presence. Such advanced malware or "stealthy malware" makes use of various techniques to impersonate or abuse benign applications and legitimate system tools to minimize its footprints in the target system. It is thus difficult for traditional detection tools, such as malware scanners, to detect it, as the malware normally does not expose its malicious payload in a file and hides its malicious behaviors among the benign behaviors of the processes. In this paper, we present PROVDETECTOR, a provenancebased approach for detecting stealthy malware. Our insight behind the PROVDETECTOR approach is that although a stealthy malware attempts to blend into benign processes, its malicious behaviors inevitably interact with the underlying operating system (OS), which will be exposed to and captured by provenance monitoring. Based on this intuition, PROVDETECTOR first employs a novel selection algorithm to identify possibly malicious parts in the OS-level provenance data of a process. It then applies a neural embedding and machine learning pipeline to automatically detect any behavior that deviates significantly from normal behaviors. We evaluate our approach on a large provenance dataset from an enterprise network and demonstrate that it achieves very high detection performance of stealthy malware (an average Fl score of 0.974). Further, we conduct thorough interpretability studies to understand the internals of the learned machine learning models.

A Hidden Process Detection Model Based on System Management Mode

Vmpmonitor: an Efficient Modularity Approach for Hidden Process Detection

On‐line Fault Detection and Diagnosis in Industrial Processes Using Hidden Markov Model

Multi-agent based hybrid Intrusion detection system

Multimode Process Monitoring Approach Based on Moving Window Hidden Markov Model

Terminal Security Monitoring Based on Power Consumption Information

Robust Dynamic Latent Variable Model for Dynamic Process Monitoring with Missing Data in Cyber-Physical Systems

You Are What You Do: Hunting Stealthy Malware Via Data Provenance Analysis

A Host-based Multi-layer Intrusion Detection Model and Its Detection Methods

Modeling program behaviors by hidden Markov models for intrusion detection

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

Hidden Markov Model-Based Statistics Pattern Analysis for Multimode Process Monitoring: an Index-Switching Scheme

Hidden Markov Model-Based Fault Detection Approach for a Multimode Process

Hidden Semi-Markov Model for Anomaly Detection

Hidden Markov Model-Based Approach for Multimode Process Monitoring

EPA-RIMM: A Framework for Dynamic SMM-based Runtime Integrity Measurement

Hidden Process Detection Based on Structural Relationship Retrieval

VDS : Malware Detection System

Detection Strategies for COM, WMI, and ALPC-Based Multi-Process Malware

HODetector: the Hidden Objects Detection Based on Static Semantic Information Library Outside Virtual Machine

Proactive Intrusion Detection Model Based on Autonomic Computing