EMD-SCS: A Dynamic Behavioral Approach for Early Malware Detection with Sonification of System Call Sequences

Problem and motivation

Malware behavior can vary across executions, and waiting for a complete system-call trace delays detection. A detector must model sequential behavior from a prefix while presenting results in a form that can complement conventional visual monitoring.

Method and contribution

The study uses the ADFA-LD Linux dataset, with system-call IDs from the stated 1–340 range, and evaluates prefixes with N=15 and M values 2, 3, 5, and 10. A sequence-to-sequence LSTM with two 256-unit layers, learning rate 0.001, and dropout 0.5 predicts future calls; BLEU and Hamming distance support classification. The output is mapped to natural and animal sounds using ChucK for sonification. Six attack categories are evaluated at partial input ratios.

Findings and evidence

The paper reports 95.465% accuracy in its M=2 setting and detection rates of 86.8% and 87.7% at 25% and 40% input, respectively, rising above 90.6% with the full sequence. The false-positive rate decreases from about 15.5% to 14.4% across the reported partial/full comparison. A preliminary user study examines the auditory presentation, but it is not a substitute for operational human-factors validation.

Limitations and future directions

Limitations: ADFA-LD is an older, single-environment dataset, and the sequence split, attack diversity, and baseline comparability constrain generalization. The sonification study is preliminary, and the paper does not establish robustness to modern malware, noisy multi-process hosts, or adversarially manipulated call sequences.

Future work: Evaluate contemporary and cross-host datasets, calibrate early-warning thresholds, test concept drift and evasion, compare audio alerts with visual and multimodal interfaces, and conduct controlled human-monitoring studies with realistic alert loads.

Sources and identifiers

• Published version published
• DBLP record public_source_record

When to cite this paper

Cite this paper when using sequence prediction and sonification for early malware detection from system-call prefixes.

• Seq2Seq LSTM prediction of future system calls from partial traces.
• BLEU/Hamming-based classification and ChucK auditory mapping.
• The ADFA-LD partial-input detection results.
• The preliminary human-factors and legacy-dataset limitations.

Citation

@inproceedings{ezzatiJivan2023emdscs,
  author = {Raghav Bhardwaj and Morteza Noferesti and Madeline Janecek and Naser Ezzati-Jivan},
  title = {EMD-SCS: A Dynamic Behavioral Approach for Early Malware Detection with Sonification of System Call Sequences},
  year = {2023},
  booktitle = {2023 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)},
  pages = {1728-1737},
  publisher = {IEEE},
  doi = {10.1109/TRUSTCOM60117.2023.00235},
  url = {https://doi.org/10.1109/TRUSTCOM60117.2023.00235}
}

Bhardwaj, R., Noferesti, M., Janecek, M., & Ezzati-Jivan, N. (2023). EMD-SCS: A Dynamic Behavioral Approach for Early Malware Detection with Sonification of System Call Sequences. In 2023 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) (pp. 1728-1737). https://doi.org/10.1109/TRUSTCOM60117.2023.00235

R. Bhardwaj, M. Noferesti, M. Janecek, and N. Ezzati-Jivan, "EMD-SCS: A Dynamic Behavioral Approach for Early Malware Detection with Sonification of System Call Sequences," in 2023 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 1728-1737, 2023, doi: 10.1109/TRUSTCOM60117.2023.00235