Beyond the File: Elevating Malware Detection through User Behavior and Source Reputation

TL;DR

Most antivirus software looks at what a file does, but ignores where it came from and who is running it. This paper introduces a Dynamic Knowledge Repository-based Security Auxiliary System that uses Attack Trees and Bayesian algorithms to weight file maliciousness based on user behavior and source credibility. The result? A system that not only detects malware with up to 91% accuracy but also teaches users to maintain better digital hygiene.

Contextualizing Host Security

The classic cat-and-mouse game of malware detection has moved from static signatures to dynamic sandbox analysis. However, there is a missing link in the chain: The Human Factor. If a user consistently downloads files from unverified websites or plugs in unknown USB drives, the baseline risk of their system is higher. Prior works often focused purely on system calls in isolation. This research shifts the focus to the Host Identity, treating the host's security as a dynamic score influenced by the user's habitual choices.

Methodology: The Architecture of Trust

The system's core novelty lies in its two-pronged approach to quantifying risk through structured trees and probabilistic weighting.

1. Behavior Interception via Sandbox

Using a kernel-level sandbox, the system intercepts API calls (HOOKAPI) to build a "Knowledge Repository." Every behavior $v$ is assigned a maliciousness probability $P(C)$ based on its frequency in known "black" (virus) vs. "white" (benign) datasets.

2. The Dual Attack Tree Model

Unlike standard attack trees where nodes are often unweighted, this system employs:

• File Weight Tree (Top-Down): Decomposes a PE file into processes and then into specific API behaviors.
• Host Weight Tree (Bottom-Up): Aggregates the risks from individual files up to their sources, and finally to the host itself.

3. Bayesian Source Calibration

The most "Academic Professional" insight here is the use of the Bayesian formula to recalculate file weight $P(D|F(i))$. If a file comes from source $F(i)$ that historically provides malware, its suspicion level is mathematically boosted, even if its local behaviors appear borderline benign.

$P(D\mid F(i))=\frac{P(F(i)\mid D)imesP(D)}{P(F(i))}$

Experimental Insights: Better Habits, Better Detection

The researchers categorized three types of users: Host A (Risky), Host B (Neutral), and Host C (Safe).

• Accuracy Lift: As user habits improved (moving from A to C), the detection rate rose from 72% to 84%.
• False Positive Reduction: Host C saw a dramatic drop in false positives (2% vs 16%). This is because a "clean" host history provides a more stable baseline, allowing the system to identify outliers more effectively.

Critical Analysis & Future Outlook

While the system presents a robust logic for behavioral security, it faces a few challenges:

• Performance Overhead: As shown in the performance testing, behavior interception is resource-heavy. Running every downloaded file in a sandbox on legacy systems (like the XP used in the study) introduces latency.
• Cold Start Problem: New file sources lack historical data ($b(i)$ values), which might lead the system to rely solely on local behavior analysis until a reputation is established.

Conclusion: This work serves as a vital bridge between traditional cybersecurity and User Entity Behavior Analytics (UEBA). By quantifying "safety consciousness," we can move toward security systems that are not just reactive scanners, but proactive assistants that guide users toward safer digital lives.