Abstract-In this paper, we present a novel framework -it uses the information in kernel structures of a process -to do run-time analysis of the behavior of an executing program. Our analysis shows that classifying a process as malicious or benign -using the information in the kernel structures of a process -is not only accurate but also has low processing overheads; as a result, this lightweight framework can be incorporated within the kernel of an operating system. To provide a proof-of-concept of our thesis, we design and implement our system as a kernel module in Linux. We perform the time series analysis of 118 parameters of Linux task structures and preprocess them to come up with a minimal features' set of 11 features. Our analysis show that these features have remarkably different values for benign and malicious processes; as a result, a number of classifiers operating on these features provide 93% detection accuracy with 0% false alarm rate within 100 milliseconds. Last but not least, we justify that it is very difficult for a crafty attacker to evade these lowlevel system specific features.
This method provides 93% detection accuracy with a 0% false alarm rate within 100 milliseconds REF .
In-Execution Malware Detection Using Task Structures of Linux Processes
2011 IEEE International Conference on Communications (ICC)
2011 IEEE International Conference on Communications (ICC)
Computer Science