Natural Language Processing based Anomalous System Call Sequences Detection with Virtual Memory Introspection

Malware has become a significant problem for the security of computers in this scientific era. Nowadays, machine learning techniques are applied to find anomalous activities in computers especially in virtualization environments. Identifying anomalous activities in virtual machines with virtual memory introspector and analyzing data with machine learning techniques are need of current trend. In this paper, an anomaly detection method is implemented using Natural Language Processing (NLP) based on Bags of System Calls (BoSC) for learning the behavior of applications on Windows virtual machines running on Xen hypervisor. During this process, system call traces are extracted from normal applications (benign processes) and malware affected applications (malicious processes) with the help of virtual memory introspection. Preprocessing of extracted system call sequences is done to obtain valid system call sequences through filtering and ordering of redundant system calls. Further, analysis of behavior of system call sequences is carried out with NLP based anomaly detection techniques. During this process, Cosine Similarity Algorithm (Co-Sim) is applied to identify malicious processes running on a VM. Apart from this, Point Detection Algorithm is applied to precisely locate the point of compromise in the system call sequences. The results shown in this paper indicates that both of these algorithms detect anomalies in the running processes with 99% accuracy.

@article{Peddoju2020,
  title     = {Natural Language Processing based Anomalous System Call Sequences Detection with Virtual Memory Introspection},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {11},
  number    = {5},
  year      = {2020},
  publisher = {The Science and Information Organization},
  author    = {Suresh K. Peddoju and Himanshu Upadhyay and Jayesh Soni and Nagarajan Prabakar},
  doi       = {10.14569/IJACSA.2020.0110559},
  url       = {https://doi.org/10.14569/IJACSA.2020.0110559}
}