Malware developers have learned how to confuse researchers who are trying to reverse engineer their methods in static analysis. Dynamic analysis monitors the computer’s behaviour during malware execution and has an advantage over static analysis as it is less susceptible to malware’s attempts of method obfuscation. With the widespread use of Linux-based Internet of Things (IoT) devices, attacks on Linux-based assets have significantly increased. Linux uses system calls to allow a user’s program to interface with the operating system’s resources. These system calls can be analyzed in a dynamic fashion to determine if malware is affecting the operating system’s behaviour. In this paper, the combination of two AI technologies, Generative Adversarial Network (GAN) and Long-Short-Term-Memory (LSTM) network are used for detecting malware in Linux systems. The experimental findings of this research show promising results for using such technology in malware detection.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Dynamic Malware Detection Using LSTM Based GANs and Linux System Calls

  • Jeffrey C. Rombough,
  • Larbi Esmahi

摘要

Malware developers have learned how to confuse researchers who are trying to reverse engineer their methods in static analysis. Dynamic analysis monitors the computer’s behaviour during malware execution and has an advantage over static analysis as it is less susceptible to malware’s attempts of method obfuscation. With the widespread use of Linux-based Internet of Things (IoT) devices, attacks on Linux-based assets have significantly increased. Linux uses system calls to allow a user’s program to interface with the operating system’s resources. These system calls can be analyzed in a dynamic fashion to determine if malware is affecting the operating system’s behaviour. In this paper, the combination of two AI technologies, Generative Adversarial Network (GAN) and Long-Short-Term-Memory (LSTM) network are used for detecting malware in Linux systems. The experimental findings of this research show promising results for using such technology in malware detection.