Learning Fast and Slow: PROPEDEUTICA for Real-time Malware Detection
Existing malware detectors on safety-critical devices have difficulties in runtime detection due to the performance overhead. In this paper, we introduce PROPEDEUTICA, a framework for efficient and effective real-time malware detection, leveraging the best of conventional machine learning (ML) and deep learning (DL) techniques. In PROPEDEUTICA, all software start execution are considered as benign and monitored by a conventional ML classifier for fast detection. If the software receives a borderline classification from the ML detector (e.g. the software is 50% likely to be benign and 50% likely to be malicious), the software will be transferred to a more accurate, yet performance demanding DL detector. To address spatial-temporal dynamics and software execution heterogeneity, we introduce a novel DL architecture (DEEPMALWARE) for PROPEDEUTICA with multi-stream inputs. We evaluated PROPEDEUTICA with 9,115 malware samples and 1,338 benign software from various categories for the Windows OS. With a borderline interval of [30%-70%], PROPEDEUTICA achieves an accuracy of 94.34% and a false-positive rate of 8.75%, with 41.45% of the samples moved for DEEPMALWARE analysis. Even using only CPU, PROPEDEUTICA can detect malware within less than 0.1 seconds.
Code (0)
등록된 구현이 없습니다.
Tasks
CPUGeneral ClassificationMalware DetectionSimilar Papers 제목 키워드 기반
MalwareDNA: Simultaneous Classification of Malware, Malware Families, and Novel Malware
Malware is one of the most dangerous and costly cyber threats to national security and a crucial factor in modern cyber-space. However, the adoption of machine learning (ML) based solutions against malware threats has be…
ClassificationAn Efficient Approach For Malware Detection Using PE Header Specification
Following the dramatic growth of malware and the essential role of computer systems in our daily lives, the security of computer systems and the existence of malware detection systems become …
BIG-bench Machine LearningMalware DetectionApplying Graph Analysis for Unsupervised Fast Malware Fingerprinting
Malware proliferation is increasing at a tremendous rate, with hundreds of thousands of new samples identified daily. Manual investigation of such a vast amount of malware is an unrealistic, time-consuming, and overwhelm…
Semantic SimilarityCommunity DetectionIoT Malware Network Traffic Classification using Visual Representation and Deep Learning
With the increase of IoT devices and technologies coming into service, Malware has risen as a challenging threat with increased infection rates and levels of sophistication. Without strong security mechanisms, a huge amo…
General ClassificationTraffic ClassificationFGAM:Fast Adversarial Malware Generation Method Based on Gradient Sign
Malware detection models based on deep learning have been widely used, but recent research shows that deep learning models are vulnerable to adversarial attacks. Adversarial attacks are to deceive the deep learning model…
Deep LearningMalware Detection