Machine Learning-based Ransomware Detection Using Low-level Memory Access Patterns Obtained From Live-forensic Hypervisor. (arXiv:2205.13765v1 [cs.CR])

Since modern anti-virus software mainly depends on a signature-based static
analysis, they are not suitable for coping with the rapid increase in malware
variants. Moreover, even worse, many vulnerabilities of operating systems
enable attackers to evade such protection mechanisms. We, therefore, developed
a thin and lightweight live-forensic hypervisor to create an additional
protection layer under a conventional protection layer of operating systems
with supporting ransomware detection using dynamic behavioral features. The
developed live-forensic hypervisor collects low-level memory access patterns
instead …

access detection forensic hypervisor live machine machine learning memory patterns ransomware ransomware detection