LEDA-Layered Event-Based Malware Detection Architecture.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• The proliferation of new malware strains demands advanced detection techniques.
• Existing machine learning approaches often rely on static file analysis or comprehensive process logs, which can be inefficient or redundant for certain malware types like ransomware.
• Real-time detection is crucial for mitigating rapidly evolving cyber threats.

Purpose of the Study:

• To introduce LEDA, a novel malware detection architecture for real-time process behavior monitoring.
• To develop a system that dynamically learns discriminative features and optimizes model evaluation for minimal user-perceived performance impact.
• To address the limitations of traditional malware detection methods, particularly for malware that announces its presence, such as ransomware.

Main Methods:

• LEDA employs a real-time process behavior monitoring approach.
• The architecture dynamically identifies and learns the most relevant features for malware detection.
• It optimally triggers model evaluations to balance detection accuracy and system performance.

Main Results:

• LEDA demonstrated effectiveness in detecting Windows malware in real-time.
• The system dynamically adapts to learn critical features, improving detection efficiency.
• Evaluation using a year-long dataset of malware and legitimate applications provided insights into the model's temporal effectiveness.

Conclusions:

• LEDA offers a promising real-time malware detection solution, outperforming traditional methods for specific threats.
• Dynamic feature learning and optimized model evaluation are key to efficient and effective malware detection.
• Further research should explore the long-term temporal decay of LEDA's effectiveness in diverse and evolving threat landscapes.