论文标题
基于机器学习的勒索软件检测，使用从实时范围内获得的低级内存访问模式
Machine Learning-based Ransomware Detection Using Low-level Memory Access Patterns Obtained From Live-forensic Hypervisor
论文作者
论文摘要
由于现代反病毒软件主要取决于基于签名的静态分析，因此它们不适合应对恶意软件变体的快速增加。而且，更糟糕的是，操作系统的许多漏洞使攻击者能够逃避这种保护机制。因此，我们开发了一种薄而轻的实用实力范围，以使用动态行为功能支持勒索软件检测，从而在传统的操作系统保护层下创建一个额外的保护层。已开发的实力范围内的管理程序收集低级内存访问模式，而不是现代虚拟机内省技术所采用的高级信息和诸如过程ID和API呼叫。然后，我们创建了三个勒索软件样本，一个刮水器恶意软件样本和四个良性应用程序的低级内存访问模式数据集。我们确认只有使用低级内存访问模式的最佳机器学习分类器在检测勒索软件和雨刮器恶意软件方面获得了0.95的$ f_1 $得分。
Since modern anti-virus software mainly depends on a signature-based static analysis, they are not suitable for coping with the rapid increase in malware variants. Moreover, even worse, many vulnerabilities of operating systems enable attackers to evade such protection mechanisms. We, therefore, developed a thin and lightweight live-forensic hypervisor to create an additional protection layer under a conventional protection layer of operating systems with supporting ransomware detection using dynamic behavioral features. The developed live-forensic hypervisor collects low-level memory access patterns instead of high-level information such as process IDs and API calls that modern Virtual Machine Introspection techniques have employed. We then created the low-level memory access patterns dataset of three ransomware samples, one wiper malware sample, and four benign applications. We confirmed that our best machine learning classifier using only low-level memory access patterns achieved an $F_1$ score of 0.95 in detecting ransomware and wiper malware.
