Dynamic Malware Detection Using LSTM Based GANs and Linux System Calls
摘要
Malware developers have learned how to confuse researchers who are trying to reverse engineer their methods in static analysis. Dynamic analysis monitors the computer’s behaviour during malware execution and has an advantage over static analysis as it is less susceptible to malware’s attempts of method obfuscation. With the widespread use of Linux-based Internet of Things (IoT) devices, attacks on Linux-based assets have significantly increased. Linux uses system calls to allow a user’s program to interface with the operating system’s resources. These system calls can be analyzed in a dynamic fashion to determine if malware is affecting the operating system’s behaviour. In this paper, the combination of two AI technologies, Generative Adversarial Network (GAN) and Long-Short-Term-Memory (LSTM) network are used for detecting malware in Linux systems. The experimental findings of this research show promising results for using such technology in malware detection.