Conference proceeding
Behavioral Malware Detection using a Language Model Classifier Trained on sys2vec Embeddings
PROCEEDINGS OF THE 57TH ANNUAL HAWAII INTERNATIONAL CONFERENCE ON SYSTEM SCIENCES, pp.7582-7591
01 Jan 2024
Abstract
Behavioral malware detection is an effective way to detect ever-changing malware. Often, kernel-level system calls are collected on device and then processed and fed to machine learning models. In this work, we show that using simple natural language processing (NLP) techniques on system calls, such as a bag-of-n-grams model, coupled with shallow machine learning classifiers, are not as useful for stealthier malware. In contrast, training a Word2Vec-like model, which we call sys2vec, on the system call traces and feeding the resulting embeddings to a language model classifier provides consistently better results. We evaluate and compare the two classifiers using Area Under the Receiver Operating Characteristic Curve (AUC) and the True Positive Rate (TPR) at an acceptable False Positive Rate (FPR). We then discuss how this work can be further expanded in the language model space going forward.
Metrics
1 Record Views
Details
- Title
- Behavioral Malware Detection using a Language Model Classifier Trained on sys2vec Embeddings
- Creators
- John Carter - Drexel Univ, Dept Comp Sci, Philadelphia, PA 19104 USASpiros Mancoridis - Drexel UniversityPavlos Protopapas - Harvard UniversityErick Galinkin - Drexel Univ, Dept Comp Sci, Philadelphia, PA 19104 USA
- Contributors
- T X Bui (Editor)
- Publication Details
- PROCEEDINGS OF THE 57TH ANNUAL HAWAII INTERNATIONAL CONFERENCE ON SYSTEM SCIENCES, pp.7582-7591
- Series
- Hawaii International Conference on System Sciences
- Publisher
- HICSS
- Number of pages
- 10
- Grant note
- Auerbach Berger Chair of Cybersecurity
- Resource Type
- Conference proceeding
- Language
- English
- Academic Unit
- Computer Science (Computing)
- Identifiers
- 991022040180804721