A fast kernel on hierarchial tree structures and its application to windows application behavior analysis

摘要: System calls have been proved to be important evidence for analyzing the behavior of running applications. However, application analyzers which investigate majority system usually suffer from severe performance deterioration or frequent crashes. In presented study, a light weighted analyzer is approached by two avenues. On one hand, computation load monitor are considerably reduced limiting target functions specific groups: file accesses and Windows Registry accesses. other analytical accuracy achieved deep inspection into string parameters function calls, where proximity programs evaluated newly proposed kernel functions. The efficacy approach on real world datasets with promising results reported.