Real-time malware process detection and automated process killing

Rhode, Matilda, Burnap, Peter ORCID: https://orcid.org/0000-0003-0396-633X and Wedgbury, Adam 2021. Real-time malware process detection and automated process killing. Security and Communication Networks 2021 , 8933681. 10.1155/2021/8933681

Preview

PDF - Published Version Available under License Creative Commons Attribution. Download (1MB) | Preview

Abstract

Perimeter-based detection is no longer sufficient for mitigating the threat posed by malicious software. This is evident as antivirus (AV) products are replaced by endpoint detection and response (EDR) products, the latter allowing visibility into live machine activity rather than relying on the AV to filter out malicious artefacts. This paper argues that detecting malware in real-time on an endpoint necessitates an automated response due to the rapid and destructive nature of some malware. The proposed model uses statistical filtering on top of a machine learning dynamic behavioural malware detection model in order to detect individual malicious processes on the fly and kill those which are deemed malicious. In an experiment to measure the tangible impact of this system, we find that fast-acting ransomware is prevented from corrupting 92% of files with a false positive rate of 14%. Whilst the false-positive rate currently remains too high to adopt this approach as-is, these initial results demonstrate the need for a detection model that is able to act within seconds of the malware execution beginning; a timescale that has not been addressed by previous work.

Item Type:	Article
Date Type:	Publication
Status:	Published
Schools:	Computer Science & Informatics
Subjects:	Q Science > QA Mathematics > QA75 Electronic computers. Computer science
Additional Information:	%is is an open access article distributed under the Creative Commons Attribution License
Publisher:	Hindawi
ISSN:	1939-0122
Funders:	Engineering and Physical Sciences Research Council
Date of First Compliant Deposit:	30 November 2021
Date of Acceptance:	15 November 2021
Last Modified:	19 May 2023 03:19
URI:	https://orca.cardiff.ac.uk/id/eprint/145509

Actions (repository staff only)

Edit Item