Enhancing Enterprise Network Security: Comparing Machine-Level and
  Process-Level Analysis for Dynamic Malware Detection
Baskoro Adi Pratomo Toby Jackson Pete Burnap Andrew Hood Eirini Anthi
Analysing malware is important to understand how malicious software works and
to develop appropriate detection and prevention methods. Dynamic analysis can
overcome evasion techniques commonly used to bypass static analysis and provide
insights into malware runtime activities. Much research on dynamic analysis
focused on investigating machine-level information (e.g., CPU, memory, network
usage) to identify whether a machine is running malicious activities. A
malicious machine does not necessarily mean all running processes on the
machine are also malicious. If we can isolate the malicious process instead of
isolating the whole machine, we could kill the malicious process, and the
machine can keep doing its job. Another challenge dynamic malware detection
research faces is that the samples are executed in one machine without any
background applications running. It is unrealistic as a computer typically runs
many benign (background) applications when a malware incident happens. Our
experiment with machine-level data shows that the existence of background
applications decreases previous state-of-the-art accuracy by about 20.12% on
average. We also proposed a process-level Recurrent Neural Network (RNN)-based
detection model. Our proposed model performs better than the machine-level
detection model; 0.049 increase in detection rate and a false-positive rate
below 0.1.