Demystifying Behavior-Based Malware Detection at Endpoints

arXiv:2405.06124v1 Announce Type: new
Abstract: Machine learning is widely used for malware detection in practice. Prior behavior-based detectors most commonly rely on traces of programs executed in controlled sandboxes. However, sandbox traces are unavailable to the last line of defense offered by security vendors: malware detection at endpoints. A detector at endpoints consumes the traces of programs running on real-world hosts, as sandbox analysis might introduce intolerable delays. Despite their success in the sandboxes, research hints at potential challenges for …

arxiv cs.cr defense detection detector endpoints line machine machine learning malware malware detection practice sandbox sandboxes security security vendors traces vendors