Towards a Theory of Generalizing System Call Representation for In-Execution Malware Detection

Abstract

The major contribution of this paper is two-folds: (1) we present our novel variable-length system call representation scheme compared to existing fixed-length sequence schemes, and (2) using this representation, we present our in-execution malware detector that can not only identify zero-day malware without any a priori knowledge but can also detect a malicious process while it is executing. Our representation scheme -a more generalized version of n-gram -can be visualized in a k-dimensional hyperspace in which processes move depending upon their sequence of system calls. The process marks its impact in space by generating hyper-grams that are later used to evaluate an unknown process according to their profile. The proposed technique is evaluated on a real world dataset extracted from a Linux System. The results of our analysis show that our in-execution malware detector with hyper-gram representation achieves low processing overheads and improved detection accuracies as compared to conventional n-grams.

Linux malware detection using non-parametric statistical methods

“…The authors in [15] proposed an enhanced variant of the above-mentioned approach known as hypergrams which represent variable length system call sequences in in-execution malware analysis and detection. A Hyperspace which is kdimensional is used to visualize the n-grams where k is the number of unique system call sequences of a process in its execution.…”

Linux Malware Detection Using eXtended–Symmetric Uncertainty

“…F alseP ositiveRate (F P R) = F P/(T N + F P ) ( 8 ) where, TP-True Positives which represent the number of correctly identified malware instances, TN-True Negatives which denote correctly classified benign samples whereas FP-False Positives designate misclassified benign files and FNFalse Negatives represents misclassified malware instances.…”

“…The authors in [8] proposed a new approach known as hypergrams to represent variable length system call sequences for in-execution malware analysis and detection. A k -dimensional hyperspace was used to visualize the n-grams where, k represents the number of unique system call sequences of a program in execution.…”

Survey on Representation Techniques for Malware Detection System

“…Representation of malware basically deals with how the collected malware samples are being transformed from specific format to another by applying certain techniques to represent them such as a system call representation technique (Mehdi et al, 2010) and Opcode sequences as representation of executable datamining-based (Santos et al, 2013). In this study, besides providing the researchers with full and comprehensive literature on malware definitions, types, various detection techniques and methods, we aim at giving researchers an idea about various techniques that are used for representing the malware samples as we will conduct a deep survey on some representations that are based on the major malware detection techniques.…”

“…In the case of the malware infecting executable codes when this happen the file or files got infected will be residing in memory the moment the user executes them and hence they will infect any other files that the user may execute afterwards. It has a tremendous negative impact on the computer security (Mehdi et al, 2010). With the use of antivirus programs and firewall many malware could be defeated "to some extent" especially those been very active through the network, but at the same time, if we disable the use of antivirus and firewalls for a single day, this may show strong proof of the fast spread of this malicious software.…”