DETECTION OF MALICIOUS ACTIVITY USING A NEURAL NETWORK FOR CONTINUOUS OPERATION

Abstract

This article describes the problem of detecting malicious programs in running systems of users of mobile applications. Because users can download any application on their phone, which over time can pull up additional settings, which can store malicious routines for monitoring both personal life and their personal data, such as logins, passwords, bank data. The detection of such routines is based on dynamic analysis and is formulated as a weakly controlled problem. The article contains an analysis of information on the development of researchers who worked on detection models and methods such as: statistical and dynamic intrusion detection methods, anomaly detection model, settings classification methods, machine and deep learning methods. Machine learning, and especially deep learning, has become an extremely useful and interesting topic in cybersecurity over the past few years. In this context, the detection of malicious software has received considerable attention. The article considers the problem of detecting the activity of malicious software of mobile operating systems in the time domain by analyzing behavioral sequences of a large amount of industrial data. When malware executes on a system, its behavior consists of a series of distinct actions placed along the time axis, and there is only a subsequence of actions that lead to malicious activity. Very often, malicious software does not manifest itself immediately, and at some point in the execution, malicious activity is formed. Therefore, the main task and difficulty is to identify such a subsequence in the entire sequence of events. Due to this, it is proposed to develop a behavior model that would analyze the dynamic behavior of the program in the system during execution. For this, a sequence of API/function calls generated by the program at runtime is used as input data and a recurrent neural network (RNN) architecture is proposed to detect malicious activity. The article describes the training method of the proposed model and provides verification of its performance on a large sample of industrial data consisting of a large number of samples generated on the emulator farm. Many mobile phone vendors strive for hardware acceleration on the device to provide better support. Therefore, it can be considered that the deployment of a model based on RNM directly on the device as one of the security levels can become a viable solution. The test data of the model described in the article show sufficiently high positive results when detecting malicious activities.