Malware is one of the most serious network security threats. To detect unknown variants of malware, many researches have proposed various methods of malware detection based on machine learning in recent years. However, modern malware is often protected by software packers, obfuscation, and other technologies, which bring challenges to malware analysis and detection. In this paper, we propose a system call based malware detection technology. By comparing malware and benign software in a sandbox environment, a sensitive system call context is extracted based on information gain, which reduces obfuscation caused by a normal system call. By using the deep belief network, we train a malware detection model with sensitive system call context to improve the detection accuracy.

No abstract

No abstract

In order to solve the problem of insufficient use of sequence information and low detection efficiency of traditional anomaly detection methods, this paper introduces Markov chain into user behaviour sequence detection, and proposes a description based on Markov chain and support vector data field ( SVDD) User Behaviour Sequence Detection Method (ASDMS), which first uses the Markov chain to accurately quantify the user behaviour sequence, then constructs the user’s normal behaviour sequence model based on the support vector data field description model, and identifies the user anomaly behaviour. The experimental results show that the ASDMS method has better performance and timeliness than the traditional abnormal behaviour detection method.

Abstract