Systems and methods including machine-learning models for detecting and mitigating malware
Disclosed herein are embodiments of systems, methods, and products comprise an analytic server, which detects and defends against malware in-flight regardless of the specific nature and methodology of the underlying attack. The analytic server learns the system's normal behavior during testing and evaluation phase and trains a machine-learning model based on the normal behavior. The analytic server monitors the system behavior during runtime comprising the runtime behavior of each sub-system of the system. The analytic server executes the machine-learning model and compares the system runtime behavior with the normal behavior to identify anomalous behavior. The analytic server executes one or more mitigation instructions to mitigate malware. Based on multiple available options for mitigating malware, the analytic server makes an intelligent decision and takes the least impactful action that have the least impact on the system to maintain mission assurance.
1. A computer-implemented method comprising:
training, by the server, a machine-learning model by applying the machine-learning model on a plurality of training kernel-level feature vectors generated for a plurality of training system calls to learn a normal behavior of the computing system, wherein the machine-learning model learns the normal behavior of the computing system based on detection results of anomalous behavior from system parameters and return values of the plurality of system calls from the plurality of training kernel-level feature vectors;
obtaining, by the server, one or more runtime system calls performed by the computing system during runtime execution; and
for each particular runtime system call of the one or more runtime system calls:
determining, by the server, a level of deviation between the runtime system call and the normal behavior of the computing system, by applying the machine-learning model on a plurality of runtime kernel-level feature vectors generated for the particular runtime system call; and
generating, by the server, a maliciousness probability for the particular runtime system call based upon the level of deviation.
2. The method according to claim 1 , wherein generating the maliciousness probability for the runtime system call includes generating, by the server, a confidence value for the runtime system call based upon the corresponding maliciousness probability and one or more weighted values.
3. The method according to claim 1 , wherein training the machine-learning model includes applying the machine-learning model on a plurality of labels corresponding to the plurality of training system calls.
4. The method according to claim 1 , further comprising instructing, by the server, the computing system to execute one or more mitigation instructions, in response to the server determining that the maliciousness probability satisfies a predetermined threshold for malware detection.
5. The method according to claim 4 , wherein the one or more mitigation instructions comprises at least one of: changing an anomalous system call parameter to a specific value, changing an anomalous return value to a specific value, halting the system calls, or executing a script on the computing system.
6. The method according to claim 4 , wherein the server determines the one or more mitigation instructions based upon the maliciousness probability generated for the current system call.
7. The method according to claim 4 , further comprising:
generating, by the server, an output of the maliciousness probability for a graphical user interface of a user; and
receiving, by the server, an input of a mitigation instruction for the runtime system call via the graphical user interface from the user.
8. The method according to claim 1 , further comprising determining, by the server, that the runtime behavior for the runtime system call deviates from the normal behavior based on a hierarchical risk model comprising an attack tree.
9. The method according to claim 1 , further comprising applying, by the server, a hybrid approach including a rules-based engine combined with the machine-learning model on one or more system calls.
10. The method according to claim 9 , wherein the rules-based approach identifies anomalous behavior in the one or more system calls using at least one of: a system argument, a parameter, or a return value.
11. A system comprising:
a server comprising a processor configured to:
train a machine-learning model by applying the machine-learning model on a plurality of training kernel-level feature vectors generated for a plurality of training system calls to learn a normal behavior of the computing system, wherein the machine-learning model learns the normal behavior of the computing system based on detection results of anomalous behavior from system parameters and return values of the plurality of system calls from the plurality of training kernel-level feature vectors;
obtain one or more runtime system calls performed by the computing system during runtime execution; and
for each particular runtime system call of the one or more runtime system calls:
determine a level of deviation between the runtime system call and the normal behavior of the computing system, by applying the machine-learning model on a plurality of runtime kernel-level feature vectors generated for the particular runtime system call; and
generate a maliciousness probability for the particular runtime system call based upon the level of deviation.
12. The system according to claim 11 , wherein, when generating the maliciousness probability for the runtime system call, the server is further configured to generate a confidence value for the runtime system call based upon the corresponding maliciousness probability and one or more weighted values.
13. The system according to claim 11 , wherein, when training the machine-learning model, the server is further configured to apply the machine-learning model on a plurality of labels corresponding to the plurality of training system calls.
14. The system according to claim 11 , wherein the server is further configured to instruct the computing system to execute one or more mitigation instructions in response to the server determining that the maliciousness probability satisfies a predetermined threshold for malware detection.
15. The system according to claim 14 , wherein the one or more mitigation instructions comprises at least one of: changing an anomalous system call parameter to a specific value, changing an anomalous return value to a specific value, halting the system calls, or executing a script on the computing system.
16. The system according to claim 14 , wherein the server is further configured to determine the one or more mitigation instructions based upon the maliciousness probability generated for the current system call.
17. The system according to claim 14 , wherein the server is further configured to:
generate an output of the maliciousness probability for a graphical user interface of a user; and
receive an input of a mitigation instruction for the runtime system call via the graphical user interface from the user.
18. The system according to claim 11 , wherein the server is further configured to determine that the runtime behavior for the runtime system call deviates from the normal behavior based on a hierarchical risk model comprising an attack tree.
19. The system according to claim 11 , wherein the server is further configured to applying, by the server, a hybrid approach including a rules-based engine combined with the machine-learning model on one or more system calls.
20. The system according to claim 19 , wherein the rules-based approach identifies anomalous behavior in the one or more system calls using at least one of: a system argument, a parameter, or a return value.