LEDA—Layered Event-Based Malware Detection Architecture

Autor: Radu Marian Portase, Raluca Laura Portase, Adrian Colesa, Gheorghe Sebestyen
Jazyk: angličtina
Rok vydání: 2024
Předmět:
Zdroj: Sensors, Vol 24, Iss 19, p 6393 (2024)
Druh dokumentu: article
ISSN: 1424-8220
DOI: 10.3390/s24196393
Popis: The rapid increase in new malware necessitates effective detection methods. While machine learning techniques have shown promise for malware detection, most research focuses on identifying malware through the content of executable files or full behavior logs collected from process start to finish. However, detecting threats like ransomware via full logs is redundant, as this malware type openly informs users of the infection. To address this, we present LEDA, a novel malware detection architecture designed to monitor process behavior during execution and to identify malicious actions in real time. LEDA dynamically learns the most relevant features for detection and optimally triggers model evaluations to minimize the performance impact perceived by users. We evaluated LEDA using a dataset of Windows malware and legitimate applications collected over a year, examining our model’s temporal decay in effectiveness.
Databáze: Directory of Open Access Journals
Nepřihlášeným uživatelům se plný text nezobrazuje