Malware detection on windows audit logs using LSTMs

doi:10.1016/j.cose.2021.102389

Malware detection on windows audit logs using LSTMs

2021-10-01

12

PRE

AI

DOI：10.1016/j.cose.2021.102389

Original

Original request for help

Save

Abstract

En 中文

Malware is a constant threat and is continuously evolving. Security systems try to keep up with the constant change. One challenge that arises is the large amount of logs generated on an operating system and the need to clarify which information contributes to the detec-tion of possible malware. This work aims at the detection of malware using neural networks based on Windows audit log events. Neural networks can only process continuous data, but Windows audit logs are sequential and textual data. To address these challenges, we ex-tract features out of the audit log events and use LSTMs to capture sequential effects. We create different subsets of features and analyze the effects of additional information. Fea-tures describe for example the action-type of windows audit log events, process names or target files that are accessed. Textual features are represented either as one-hot encoding or embedding representation, for which we compare three different approaches for represen-tation leaming. Effects of different feature subsets and representations are evaluated on a publicly available data set. Results indicate that using additional information improves the performance of the LSTM-model. While different representations lead to similar classifica-tion results, analysis of the latent space shows differences more precisely where FastText seems to be the most promising representation. (c) 2021 Elsevier Ltd. All rights reserved.

Keywords:

Malware

LSTM

Embeddings

Windows audit logs

Malware detection on windows audit logs using LSTMs

Abstract

AI Summary

Journal

Organization