You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis

By Qi Wang, Wajih Ul Hassan, Ding Li, Kangkook Jee, Xiao Yu, Kexuan Zou, J. Rhee, Zhengzhang Chen, Wei Cheng, Carl A. Gunter and 1 more. Network and Distributed System Security Symposium, 2020

312 citations recorded by the source corpus.

—To subvert recent advances in perimeter and host security, the attacker community has developed and employed various attack vectors to make a malware much stealthier than before to penetrate the target system and prolong its presence. Such advanced malware or “stealthy malware” makes use of various techniques to impersonate or abuse benign applications and legitimate system tools to minimize its footprints in the target system. It is thus difficult for traditional detection tools, such as malware scanners, to detect it, as the malware normally does not expose its malicious payload in a file and hides its malicious behaviors among the benign behaviors of the processes. In this paper, we present P ROV D ETECTOR , a provenance-based approach for detecting stealthy malware. Our insight behind the P ROV D ETECTOR approach is that although a stealthy malware attempts to blend into benign processes, its malicious behaviors inevitably interact with the underlying operating system (OS), which will be exposed to and captured by provenance monitoring. Based on this intuition, P ROV D ETECTOR first employs a novel selection algorithm to identify possibly malicious parts in the OS-level provenance data of a process. It then applies a neural embedding and machine learning pipeline to automatically detect any behavior that deviates significantly from normal behaviors. We evaluate our approach on a large provenance dataset from an enterprise network and demonstrate that it achieves very high detection performance of stealthy malware (an average F1 score of 0.974). Further, we conduct thorough interpretability studies to understand the internals of the learned machine learning models

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/1b12fbe7d9f7cd251a40e099e66e65f635b873ff

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

  1. Adam Bates
  2. Daniel Marino
  3. Wajih Ul Hassan

In Information Systems

  1. Adam Bates

In Signal Processing

  1. Adam Bates
  2. Daniel Marino
  3. Wajih Ul Hassan

Citations in the corpus