Detection of malicious behaviour of computer program

Abstract

Method for determining real-time malicious behavior of a computer program, such as on Android systems. A first sequence of APIs from a total sequence of intercepted APIs generated by the computer program are saved and converted into vector representation and comprise inputs, together with statistical information about API's in the first sequence and APIs in the total sequence, for determining whether the behavior of the computer program constitutes abnormal behavior of the computer program.Determining uses pre-trained dataset and model in various types of machine learning.

Description

technical field

[0001] The invention relates to computer science, in particular to a real-time detection of whether the behavior of a computer program is abnormal. Judging based on the following inputs: 1. Selecting a recent subset of system class calls from a large set of intercepted system class calls of computer programs. 2. Statistics related to system class calls in subsets and large collections. The pre-trained judgment module uses machine learning to judge whether an input indicates anomalous behavior. In order to reduce the computation and storage requirements of devices such as mobile devices, the input is converted into a vector representation, only a recent subset is stored, and the statistics include information that is relatively old. Background technique

[0002] According to a report by G Data, an information security company (C. Luek "8,400 New Android Malware Samples Every Day"), 8,400 Android malware were found every day in 2017, that is, a new Android ma...

Images