CROSS-REFERENCE TO RELATED APPLICATIONS

This application relates to U.S. application Ser. No. 16/012,651, filed Jun. 19, 2018, titled “Systems and Methods for Improving the Ranking and Prioritization of Attack-Related Events,” U.S. application Ser. No. 15/485,784, filed Apr. 12, 2017, titled “Software Assurance System for Runtime Environments,” and U.S. application Ser. No. 15/622,434, filed Jun. 14, 2017, titled “Software Assurance for Heterogeneous Distributed Computing Systems,” each of which is hereby incorporated by reference in its entirety.

TECHNICAL FIELD

This application relates generally to methods and systems for malware detection and mitigation.

BACKGROUND

Sophisticated latent malware is an increasing threat to computing systems and impedes mission assurance. The latent malware may remain undetected during development, testing and evaluation, mission preparation, and platform maintenance. Conventional cybersecurity approaches to thwarting the latent malware are not sufficient for detecting and warding off cyberattacks. Attackers may continually develop increasingly invasive malware using zero-day exploits with obfuscation to prevent detection. Conventional signature based anti-virus solutions may therefore be easily subverted. These anti-virus solutions rely upon signatures of known malwares and fail to identify new malwares.

Latent malware may add an additional layer of difficulty in detecting malicious behavior because a malware may not be active until runtime or critical stages of runtime. For example, malwares are programmed to stay inactive until a system state is met before activation. For example, a latent malware may obfuscate its payload until it is on the target systems. This can be especially effective in weapon systems by waiting until the systems is being used in a live mission. This may make file system baselining ineffective because a third-party software supply chain may be compromised and inadvertently submit binaries with built-in latent malware. Subsequent baselines may believe that software is trusted and subvert file integrity monitoring.

The second shortcoming of the conventional automated anti-virus solutions is that they do not provide adequate tools to make intelligent reactionary measure. Specific components may require a more sophisticated response for the system to remain functional as a whole. Real-time human-in-the-loop solutions may also not be feasible due to time constraints or the inability for a human to interact with the system. Communications could be interrupted, delayed, or not enough information could be available for a human to respond in a way that would reasonably prevent the damage of the malware.

SUMMARY

What is therefore desired are systems and method for detecting and defending against malwares during runtime of a computing system regardless of the specific nature and methodology of the underlying attack. The systems and methods may not have an a priori knowledge of the signatures of the malwares. Embodiments described herein attempt a technical solution to the aforementioned technical problems and may provide solutions to other programs as well. Embodiments disclosed herein describe an illustrative cybersecurity system that may learn a computing system's normal behavior during testing and evaluation phase and identify potential threats when the computing system diverges from the learned expected behavior during runtime. The cybersecurity system may comprise a kernel-based system call interception monitor that may utilize analysis of the system during normal operation to detect malicious behavior during a live mission. The cybersecurity system may train a machine-learning model based on the normal behavior during the testing and evaluation phase. The cybersecurity system may monitor the computing system behavior during runtime and compare the runtime behavior with the normal behavior using the machine-learning model to detect potential threats.

The cybersecurity system may also perform automatic operations to prevent malware based on intelligent decisions on impact of the malware. The cybersecurity system may not disrupt or reduce the performance of the computing system as a whole by doing an impact assessment of the malicious behavior. The cybersecurity system may weigh the malicious behavior against available options to select the least damaging recourse to system operation. Furthermore, the cybersecurity system may utilize lightweight anomaly detection algorithms and may have an insignificant impact on the system performance.

In one embodiment, a computer-implemented method comprises generating, by a server, kernel level feature vectors of system call hierarchy during testing phase of a computing system; training, by the server, a machine-learning model based upon the kernel level feature vectors for the machine-learning model to learn a normal behavior of the computing system; retrieving, by the server, a first set of system calls of a first sub-system of the computing system during runtime of the computing system; retrieving, by the server, a second set of system calls of a second sub-system of the computing system during runtime of the computing system; executing, by the server, the machine-learning model on the first and the second sets of system calls to compare the runtime behavior of the computing system with the normal behavior; and in response to the server determining that the runtime behavior deviates from the normal behavior over a predetermined threshold: instructing, by the server, the computing system to execute one or more mitigation instructions.

In another embodiment, a computer system comprises a computing system comprising a first sub-system and a second sub-system; a server in communication with the computing system and configured to: generate kernel level feature vectors of system call hierarchy during testing phase of the computing system; train a machine-learning model based upon the kernel level feature vectors for the machine-learning model to learn a normal behavior of the computing system; retrieve a first set of system calls of the first sub-system of the computing system during runtime of the computing system; retrieve a second set of system calls of the second sub-system of the computing system during runtime of the computing system; execute the machine-learning model on the first and the second sets of system calls to compare the runtime behavior of the computing system with the normal behavior; and in response to determining that the runtime behavior deviates from the normal behavior over a predetermined threshold: instruct the computing system to execute one or more mitigation instructions.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed.

