Detecting Anomalous Application Behaviors Using a System Call Clustering Method over Critical Resources

摘要: Malware attacks which focus on exploiting an application to launch the payload have become major security threat. We present methodology and algorithm is able detect anomaly in behavior prevent such type of attacks. Our approach represent normal application, deviations from this them. using system calls made over critical resources by clustering these then monitor applications for any behavior, means enforcement algorithm. Any mismatch indicates anomaly. provide a description our approach. implemented tested proposed results are encouraging. As compared previous research direction, we implement Windows OS instead Linux use minifilter registry callback techniques raw call interception prohibited latest operating versions.