Identifying stealth malware using CPU power consumption and learning algorithms

Simple item page
dc.contributor.authorLucket, Patrick
dc.contributor.authorMcDonald, J. Todd
dc.contributor.authorGlisson, William Bradley
dc.contributor.authorBenton, Ryan
dc.contributor.authorDawson, Joel
dc.contributor.authorDoyle, Blair A.
dc.date.accessioned2018-10-08T14:52:20Z
dc.date.available2018-10-08T14:52:20Z
dc.date.issued2018
dc.descriptionThis is a post-print version of this article to see the final version go to the following citation Patrick Luckett, J. Todd McDonald, William B. Glisson, Ryan Benton, Joel Dawson, Blair A. Doyle, "Identifying stealth malware using CPU power consumption and learning algorithms". Journal of Computer Security 26(2018) 589-613. DOI 10.3233/JCS-171060
dc.description.abstractWith the increased assimilation of technology into all aspects of everyday life, rootkits pose a credible threat to individuals, corporations, and governments. Using various techniques, rootkits can infect systems and remain undetected for extended periods of time. This threat necessitates the careful consideration of real-time detection solutions. Behavioral detection techniques allow for the identification of rootkits with no previously recorded signatures. This research examines a variety of machine learning algorithms, including Nearest Neighbor, Decision Trees, Neural Networks, and Support Vector Machines, and proposes a behavioral detection method based on low yield CPU power consumption. The method is evaluated onWindows 10, Ubuntu Desktop, and Ubuntu Server operating systems along with employing three different rootkits. Relevant features within the data are calculated and the overall best performing algorithms are identified. A nested neural network is then applied that enables highly accurate data classification. Our results present a viable method of rootkit detection that can operate in real-time with minimal computational and space complexity.en_US
dc.description.departmentComputer Science
dc.identifier.citationPatrick Luckett, J. Todd McDonald, William B. Glisson, Ryan Benton, Joel Dawson, Blair A. Doyle, "Identifying stealth malware using CPU power consumption and learning algorithms". Journal of Computer Security 26(2018) 589-613. DOI 10.3233/JCS-171060en_US
dc.identifier.urihttps://hdl.handle.net/20.500.11875/2420
dc.language.isoen_USen_US
dc.publisherJournal of Computer Securityen_US
dc.subjectRootkiten_US
dc.subjectAnomaly Detectionen_US
dc.subjectMachine Learningen_US
dc.titleIdentifying stealth malware using CPU power consumption and learning algorithmsen_US
dc.typeArticleen_US

Files

Original bundle

Now showing 1 - 1 of 1
Thumbnail Image
Name:
Identifying Stealth Malware using CPU.pdf
Size:
669.01 KB
Format:
Adobe Portable Document Format
Description:
Article
Download

Collections

Department of Computer Science
Cyber Forensics Intelligence Center