Evasive Malware Detection Using Groups of Processes

摘要: Fueled by a recent boost in revenue, cybercriminals are developing increasingly sophisticated and advanced malicious applications. This new generation of malware is able to avoid most the existing detection methods. Even behavioral solutions no longer immune evasion, mostly because focus on actions or characteristics single process. We propose shifting from as component more accurate perspective multi-component systems. dynamic solution that identifies groups related processes, analyzes performed processes these using heuristics evaluates their behavior such even evasive, multiprocess can be detected. Using information provided once has been detected, comprehensive system cleanup performed, ensure all traces an attack have removed at risk.