Imad: in-execution malware analysis and detection

The sophistication of computer malware is becoming a se-rious threat to the information technology infrastructure, which is the backbone of modern e-commerce systems. We, therefore, advocate the need for developing sophisticated, ef-ficient, and accurate malware classification techniques that can detect a malware on the first day of its launch – com-monly known as “zero-day malware detection”. To this end, we present a new technique, IMAD, that can not only iden-tify zero-day malware without any apriori knowledge but can also detect a malicious process while it is executing (in-execution detection). The capability of in-execution mal-ware detection empowers an operating system to immedi-ately kill it before it can cause any significant damage. IMAD is a realtime, dynamic, efficient, in-execution zero-day mal-ware detection scheme, which analyzes the system call se-quence of a process to classify it as malicious or benign. We use Genetic Algorithm to optimize system parameters of our scheme. The evolutionary algorithm is evaluated on real world synthetic data extracted from a Linux system. The results of our experiments show that IMAD achieves more than 90 % accuracy in classifying in-execution processes as benign or malicious. Moreover, our scheme can classify ap-proximately 50 % of malicious processes within first 20 % of their system calls