Learning Fast and Slow: Propedeutica for Real-Time Malware Detection.

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Runtime malware detection on safety-critical devices is challenged by performance overhead.
• Existing solutions often struggle to balance detection accuracy and system performance.

Purpose of the Study:

• Introduce Propedeutica, a novel framework for efficient and effective real-time malware detection.
• Leverage a hybrid approach combining conventional machine learning (ML) and deep learning (DL) techniques.

Main Methods:

• Propedeutica employs a two-stage detection process: initial ML classification followed by DL analysis for borderline cases.
• A novel deep learning architecture, DeepMalware, with multistream inputs is introduced to handle spatial-temporal dynamics and software heterogeneity.
• The framework was evaluated on Windows OS using 9115 malware and 1338 benign software samples.

Main Results:

• Propedeutica achieved 94.34% accuracy with an 8.75% false-positive rate using a [30%, 70%] borderline interval.
• 41.45% of samples were escalated for DeepMalware analysis.
• Malware detection was achieved in under 0.1 seconds, even on CPU-only systems.

Conclusions:

• Propedeutica provides an efficient and accurate solution for real-time malware detection on safety-critical devices.
• The hybrid ML/DL approach effectively manages performance overhead while maintaining high detection rates.
• The novel DeepMalware architecture demonstrates capability in analyzing complex software execution patterns.