Name
Abstract | ||
|---|---|---|
System call analysis is a behavioral malware detection technique that is popular due to its promising detection results and ease of implementation. This study describes a system that uses system call analysis to detect malware that evade traditional defenses. The system monitors executing processes to identify compromised hosts in production environments. Experimental results compare the effectiveness of multiple feature extraction strategies and detectors based on their detection accuracy at low false positive rates. Logistic regression and support vector machines consistently outperform log-likelihood ratio and signature detectors as processing and detection methods. A feature selection study indicates that a relatively small set of system call 3-grams provide detection accuracy comparable to that of more complex models. A case study indicates that the detection system performs well against a variety of malware samples, benign workloads, and host configurations. |
Year | DOI | Venue |
|---|---|---|
2015 | 10.1109/QRS.2015.26 | QRS |
Keywords | Field | DocType |
malware,detection,machine learning,system call analysis | Data mining,Feature selection,Computer science,Support vector machine,Feature extraction,System call,Software,Artificial intelligence,Malware,Detector,Small set,Machine learning | Conference |
Citations | PageRank | References |
8 | 0.46 | 22 |
Authors | ||
3 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Raymond Canzanese | 1 | 26 | 2.23 |
| Spiros Mancoridis | 2 | 888 | 56.82 |
| Moshe Kam | 3 | 290 | 49.13 |