TY - GEN
T1 - A Planning Approach to Monitoring Computer Programs’ Behavior
AU - Cukier, Alexandre
AU - Brafman, Ronen I.
AU - Perkal, Yotam
AU - Tolpin, David
N1 - Publisher Copyright:
© 2018, Springer International Publishing AG, part of Springer Nature.
PY - 2018/1/1
Y1 - 2018/1/1
N2 - We describe a novel approach to monitoring high level behaviors using concepts from AI planning. Our goal is to understand what a program is doing based on its system call trace. This ability is particularly important for detecting malware. We approach this problem by building an abstract model of the operating system using the STRIPS planning language, casting system calls as planning operators. Given a system call trace, we simulate the corresponding operators on our model and by observing the properties of the state reached, we learn about the nature of the original program and its behavior. Thus, unlike most statistical detection methods that focus on syntactic features, our approach is semantic in nature. Therefore, it is more robust against obfuscation techniques used by malware that change the outward appearance of the trace but not its effect. We demonstrate the efficacy of our approach by evaluating it on actual system call traces.
AB - We describe a novel approach to monitoring high level behaviors using concepts from AI planning. Our goal is to understand what a program is doing based on its system call trace. This ability is particularly important for detecting malware. We approach this problem by building an abstract model of the operating system using the STRIPS planning language, casting system calls as planning operators. Given a system call trace, we simulate the corresponding operators on our model and by observing the properties of the state reached, we learn about the nature of the original program and its behavior. Thus, unlike most statistical detection methods that focus on syntactic features, our approach is semantic in nature. Therefore, it is more robust against obfuscation techniques used by malware that change the outward appearance of the trace but not its effect. We demonstrate the efficacy of our approach by evaluating it on actual system call traces.
UR - https://www.scopus.com/pages/publications/85049033618
U2 - 10.1007/978-3-319-94147-9_19
DO - 10.1007/978-3-319-94147-9_19
M3 - Conference contribution
AN - SCOPUS:85049033618
SN - 9783319941462
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 243
EP - 254
BT - Cyber Security Cryptography and Machine Learning - Second International Symposium, CSCML 2018, Proceedings
A2 - Dinur, Itai
A2 - Dolev, Shlomi
A2 - Lodha, Sachin
PB - Springer Verlag
T2 - 2nd International Symposium on Cyber Security Cryptography and Machine Learning, CSCML 2018
Y2 - 21 June 2018 through 22 June 2018
ER -