Deep-Hook: A trusted deep learning-based framework for unknown malware detection and classification in Linux cloud...

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Cloud computing and virtual machines (VMs) are integral to modern IT infrastructure.
• Linux is the predominant OS in public cloud environments, making it a prime target for sophisticated malware.
• Existing malware detection solutions struggle with novel, evasive threats and can be compromised.

Purpose of the Study:

• To propose Deep-Hook, a trusted framework for detecting unknown malware in Linux cloud environments.
• To address the limitations of current antivirus and malware detection systems.
• To develop a reliable and advanced mechanism for identifying unseen threats.

Main Methods:

• Deep-Hook hooks VM volatile memory to obtain memory dumps during operation.
• Memory dumps are converted into visual images for analysis.
• A convolutional neural network (CNN) classifier analyzes these images to detect malware footprints.

Main Results:

• Deep-Hook demonstrated high agility and eliminated the need for expert-defined features.
• The framework effectively analyzes entire memory dumps for comprehensive threat detection.
• Experimental results showed up to 99.9% AUC and accuracy in detecting known and unknown malware, including rootkits.

Conclusions:

• Deep-Hook provides an effective, efficient, and accurate solution for unknown malware detection in Linux cloud environments.
• The CNN-based image analysis of memory dumps offers a superior approach to traditional methods.
• The trusted framework enhances cloud security by reliably identifying sophisticated and evasive cyber threats.