Multi-Channel Change-Point Malware Detection

• US 20150295945A1
• Filed: 04/14/2015
• Published: 10/15/2015
• Est. Priority Date: 04/14/2014
• Status: Active Grant

• Current Assignee: Drexel University
• Original Assignee: Drexel University
• Inventors: Mancoridis, Spiros, Kam, Moshe, Canzanese, Raymond Joseph Jr.
• Granted Patent: US 9,853,997 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

A malware detection system and method detects changes in host behavior indicative of malware execution. The system uses linear discriminant analysis (LDA) for feature extraction, multi-channel change-point detection algorithms to infer malware execution, and a data fusion center (DFC) to combine local decisions into a host-wide diagnosis. The malware detection system includes sensors that monitor the status of a host computer being monitored for malware, a feature extractor that extracts data from the sensors corresponding to predetermined features, local detectors that perform malware detection on each stream of feature data from the feature extractor independently, and a data fusion center that uses the decisions from the local detectors to infer whether the host computer is infected by malware.

Claims

1. A malware detection system comprising:

sensors that monitor the status of a host computer being monitored for malware, including malware that do not propagate through a network;

a feature extractor that extracts data from the sensors corresponding to predetermined features;

local detectors that perform malware detection on each stream of feature data from the feature extractor independently; and

a data fusion center that uses the decisions from the local detectors to infer whether the host computer is infected by malware.

2. The malware detection system of claim 1, wherein each sensor monitors a distinct operating phenomenon of the host computer and reports its raw data once per sampling period.

3. The malware detection system of claim 1, wherein the sensor data are processed by the feature extractor to transform raw sensor data into a set of features to use for detection of malware.

4. The malware detection system of claim 1, wherein the local detectors each sequentially monitors a single stream of feature data from the feature extractor and detects whether a change has occurred in a distribution of the feature data.

5. The malware detection system of claim 4, wherein the local detectors provide a new decision every sampling period regarding whether a change has occurred in the distribution of the feature data.

6. The malware detection system of claim 4, wherein the local sequential detectors each perform an implementation of a change-point detection technique comprising a Page'"'"'s cumulative sum (CUSUM) test.

7. The malware detection system of claim 6, wherein the CUSUM test is implemented as a repeated cumulative log-likelihood ratio test with an adaptive detection threshold.

8. The malware detection system of claim 6, wherein the feature extractor selects the predetermined features by performing a two-sample Kolmogorov-Smirnov test on the feature data to determine for each extracted feature and each malware sample whether the feature exhibits a change in distribution after the host computer is infected and, prior to using the CUSUM test, eliminates those features whose data are not informative for malware detection using the CUSUM test.

9. The malware detection system of claim 1, wherein the predetermined features include at least one of processor hypercalls/second, interrupt hypercalls/second, large page translation lookaside buffer fills/second, percent privileged time, MSR accesses cost, CPUID instructions cost, outbound connections/second, miniport send cycles/second, stack retrieve indication cycles/second, and NDIS receive indication cycles/second.

10. The malware detection system of claim 1, wherein the feature extractor transforms the predetermined features through feature scaling, in which normalization is used for the performance monitor data and a term frequency-inverse document frequency (TF-IDF) transformer for feature data samples, a feature reduction step in which principal component analysis (PCA) is used to remove redundancy in the feature data samples, and a second feature reduction step in which linear discriminant analysis (LDA) is used to project the feature data samples onto a low-dimensional space that optimally separates the clean and infected datasets.

11. The malware detection system of claim 10, wherein the TF-IDF transformer scales the feature data samples and deemphasizes the most commonly called system functions, computes products of term frequency tf and inverse document frequency idf, and scales the term frequency proportionally to a number of calls to a system function per second.

12. The malware detection system of claim 1, wherein the data fusion center receives decisions from the local detectors regarding the existence of malware in the feature data each sampling period and combines the decisions from the local detectors into a single malware diagnosis for the host computer.

13. The malware detection system of claim 1, wherein the data fusion center employs a k out of N fusion rule, where k is a threshold of a number of positive detections and N is a total number of decisions reported by the local detectors, where N=2M and M is the number of local detectors.

14. The malware detection system of claim 12, wherein the data fusion center tracks times at which decisions are made by the local detectors.

25. The method of claim 12, wherein the step of inferring whether the host computer is infected by malware comprises tracking times at which decisions are made in the malware detecting step.

15. A method for detecting malware that has infected a host computer, comprising the steps of:

monitoring the status of the host computer being monitored for malware, including malware that do not propagate through a network;

extracting feature data produced in said monitoring step that corresponds to predetermined features;

detecting malware in each stream of feature data independently; and

using detection decisions from the malware detecting step to infer whether the host computer is infected by malware.

16. The method of claim 15, wherein the malware detecting step comprises sequentially monitoring streams of extracted feature data and detecting whether a change has occurred in a distribution of the feature data.

17. The method of claim 16, wherein the malware detecting step further comprises implementing a change-point detection technique comprising a Page'"'"'s cumulative sum (CUSUM) test.

18. The method of claim 17, wherein the CUSUM test is implemented as a repeated cumulative log-likelihood ratio test with an adaptive detection threshold.

19. The method of claim 17, wherein the extracting feature data step comprises selecting the predetermined features by performing a two-sample Kolmogorov-Smirnov test on the feature data to determine for each feature sample and each malware sample whether the feature exhibits a change in distribution after the host computer is infected and, prior to using the CUSUM test, eliminating those features whose data are not informative for malware detection using the CUSUM test.

20. The method of claim 15, wherein the predetermined features include at least one of processor hypercalls/second, interrupt hypercalls/second, large page translation lookaside buffer fills/second, percent privileged time, MSR accesses cost, CPUID instructions cost, outbound connections/second, miniport send cycles/second, stack retrieve indication cycles/second, and NDIS receive indication cycles/second.

21. The method of claim 15, wherein the extracting feature data step includes transforming the predetermined features through feature scaling, in which normalization is used for the performance monitor data and a term frequency-inverse document frequency (TF-IDF) transformer for the feature data samples, a feature reduction step in which principal component analysis (PCA) is used to remove redundancy in the feature data samples, and a second feature reduction step in which linear discriminant analysis (LDA) is used to project the feature data samples onto a low-dimensional space that optimally separates the clean and infected datasets.

22. The method of claim 21, further comprising scaling the feature data samples and deemphasizing the most commonly called system functions, computing products of term frequency tf and inverse document frequency idf, and scaling the term frequency proportionally to a number of calls to a system function per second.

23. The method of claim 15, wherein the step of inferring whether the host computer is infected by malware comprises receiving decisions regarding the existence of malware in the feature data each sampling period and combining the decisions into a single malware diagnosis for the host computer.

24. The method of claim 15, wherein the step of inferring whether the host computer is infected by malware comprises employing a k out of N fusion rule, where k is a threshold of a number of positive detections and N is a total number of decisions reported, where N=2M and M is a number of detectors.