Malware Detection using Behavioral Whitelisting of Computer Systems

Malware detection has been an active area of research for a long time. With the rapid growth of self-mutating malware, many malware-detection tools fail quickly or have a high rate of false positives. Our work tackles the problem differently by creating anomaly detectors for computer systems. Since the number of potential malware far exceeds the number of benign software on any given computer system, our thesis is that it is possible to efficiently detect malware as anomalies in the expected behavior of computer systems hosting only benign software. This is in contrast to traditional approaches that attempt to construct behavioral models for every possible instance or type of malware.