Spatial and temporal convolution networks for system calls based process monitoring

Abstract

The systems and methods that detect a malicious process using count vectors are provided. Count vectors store a number and types of system calls that a process executed in a configurable time interval. The count vectors are provided to a temporal convolution network and a spatial convolution network. The temporal convolution network generates a temporal output by passing the count vectors through temporal filters that identify temporal features of the process. The spatial convolution network generates a spatial output by passing the count vectors through spatial filters that identify spatial features of the process. The temporal output and the spatial output are merged into a summary representation of the process. The malware detection system uses the summary representation to determine that the process as a malicious process.