We gratefully acknowledge support from
the Simons Foundation and member institutions.
Full-text links:


Current browse context:


Change to browse by:


References & Citations

DBLP - CS Bibliography


(what is this?)
CiteULike logo BibSonomy logo Mendeley logo del.icio.us logo Digg logo Reddit logo ScienceWISE logo

Computer Science > Cryptography and Security

Title: Online Malware Classification with System-Wide System Calls in Cloud IaaS

Abstract: Accurately classifying malware in an environment allows the creation of better response and remediation strategies by cyber analysts. However, classifying malware in a live environment is a difficult task due to the large number of system data sources. Collecting statistics from these separate sources and processing them together in a form that can be used by a machine learning model is difficult. Fortunately, all of these resources are mediated by the operating system's kernel. User programs, malware included, interacts with system resources by making requests to the kernel with system calls. Collecting these system calls provide insight to the interaction with many system resources in a single location. Feeding these system calls into a performant model such as a random forest allows fast, accurate classification in certain situations. In this paper, we evaluate the feasibility of using system call sequences for online malware classification in both low-activity and heavy-use Cloud IaaS. We collect system calls as they are received by the kernel and take n-gram sequences of calls to use as features for tree-based machine learning models. We discuss the performance of the models on baseline systems with no extra running services and systems under heavy load and the performance gap between them.
Comments: Accepted at the IEEE 23rd International Conference on Information Reuse and Integration for Data Science
Subjects: Cryptography and Security (cs.CR)
Cite as: arXiv:2208.04891 [cs.CR]
  (or arXiv:2208.04891v1 [cs.CR] for this version)

Submission history

From: Maanak Gupta [view email]
[v1] Tue, 9 Aug 2022 16:44:01 GMT (532kb,D)

Link back to: arXiv, form interface, contact.