Independent malware detection architecture
Abstract
A system and method (referred to as the system) detect malware by training a rule-based model, a functional based model, and a deep learning-based model from a memory snapshot of a malware free operating state of a monitored device. The system extracts a feature set from a second memory snapshot captured from an operating state of the monitored device and processes the feature set by the rule-based model, the functional-based model, and the deep learning-based model. The system identifies identifying instances of malware on the monitored device without processing data identifying an operating system of the monitored device, data associated with a prior identification of the malware, data identifying a source of the malware, data identifying a location of the malware on the monitored device, or any operating system specific data contained within the monitored device.
- Inventors:
- Issue Date:
- Research Org.:
- STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH AND DEVELOPMENT These inventions were made with United States government support under Contract No. DE-AC05-000R22725 awarded by the United States Department of Energy. The United States government has certain rights in the inventions.
- Sponsoring Org.:
- USDOE
- OSTI Identifier:
- 1998261
- Patent Number(s):
- 11620384
- Application Number:
- 16/530,054
- Assignee:
- UT-Battelle, LLC (Oak Ridge, TN)
- DOE Contract Number:
- AC05-00OR22725
- Resource Type:
- Patent
- Resource Relation:
- Patent File Date: 08/02/2019
- Country of Publication:
- United States
- Language:
- English
Citation Formats
Smith, Jared M., Petrik, Rachel L., and Arik, Berat E. Independent malware detection architecture. United States: N. p., 2023.
Web.
Smith, Jared M., Petrik, Rachel L., & Arik, Berat E. Independent malware detection architecture. United States.
Smith, Jared M., Petrik, Rachel L., and Arik, Berat E. Tue .
"Independent malware detection architecture". United States. https://www.osti.gov/servlets/purl/1998261.
@article{osti_1998261,
title = {Independent malware detection architecture},
author = {Smith, Jared M. and Petrik, Rachel L. and Arik, Berat E.},
abstractNote = {A system and method (referred to as the system) detect malware by training a rule-based model, a functional based model, and a deep learning-based model from a memory snapshot of a malware free operating state of a monitored device. The system extracts a feature set from a second memory snapshot captured from an operating state of the monitored device and processes the feature set by the rule-based model, the functional-based model, and the deep learning-based model. The system identifies identifying instances of malware on the monitored device without processing data identifying an operating system of the monitored device, data associated with a prior identification of the malware, data identifying a source of the malware, data identifying a location of the malware on the monitored device, or any operating system specific data contained within the monitored device.},
doi = {},
journal = {},
number = ,
volume = ,
place = {United States},
year = {2023},
month = {4}
}
Save to My Library
You must Sign In or Create an Account in order to save documents to your library.
Works referenced in this record:
System Memory Integrity Monitoring
patent-application, August 2016
- Fraser, Timothy Jon; Molina-Terriza, Jesus Maria; Petroni, Nick Louis
- US Patent Application 14/618997; 20160232354
Trusted detection of ransomware in a private cloud using machine learning methods leveraging meta-features from volatile memory
journal, July 2018
- Cohen, Aviad; Nissim, Nir
- Expert Systems with Applications, Vol. 102
Malware Analysis and Recovery
patent-application, June 2018
- Smith, Jared M.
- US Patent Application 15/837942; 20180167403
Automated Forensics of Computer Systems Using Behavioral Intelligence
patent-application, December 2015
- Mumcuoglu, Michael; Engel, Giora; Firstenberg, Eyal
- US Patent Application 14/758966; 20150358344
Automated malware detection using artifacts in forensic memory images
conference, May 2016
- Mosli, Rayan; Li, Rui; Yuan, Bo
- 2016 IEEE Symposium on Technologies for Homeland Security (HST)
System and Method of Performing Memory Data Collection for Memory Forensics in a Computing Device
patent-application, July 2018
- Gathala, Sudha Anil Kumar; Salajegheh, Mastooreh; Das, Saumitra Mohan
- US Patent Application 15/407390; 20180203996
Bare-metal computer security appliance
patent, July 2016
- Lukacs, Sandor; Colesa, Adrian V.
- US Patent Document 9,383,934
Automated Classification of Exploits Based on Runtime Environmental Features
patent-application, June 2018
- Guri, Mordechai; Gorelik, Michael; Yehoshua, Ronen
- US Patent Application 15/324659; 20180181752
Malware Detection with Deep Neural Network Using Process Behavior
conference, June 2016
- Tobiyama, Shun; Yamaguchi, Yukiko; Shimada, Hajime
- 2016 IEEE 40th Annual Computer Software and Applications Conference (COMPSAC)
Method and System for Automatic Detection and Analysis of Malware
patent-application, March 2012
- Thomas, Ralph; Ligh, Michael
- US Patent Application 13/219208; 20120079596
Demo
conference, October 2017
- Smith, Jared M.; Greenlee, Elliot; Ferber, Aaron
- Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security
Malware Detection
patent-application, February 2011
- Stahlberg, Mika
- US Patent Application 12/462913; 20110041179
Periodic Mobile Forensics
patent-application, April 2015
- Guido, Mark D.
- US Patent Application 14/062513; 20150121522