The rapid growth of Cloud Computing and Internet of Things (IoT) has significantly increased the interconnection of computational resources, creating an environment where malicious software (malware) can spread rapidly. To address this challenge, researchers are increasingly utilizing Machine Learning approaches to identify malware through behavioral (i.e. dynamic) cues. However, current approaches are limited by their reliance on large labeled datasets, fixed model training, and the assumption that a trained model remains effective over time-disregarding the ever-evolving sophistication of malware. As a result, they often fail to detect evolving malware attacks that adapt over time. This paper proposes an online learning approach for dynamic malware detection, that overcomes these limitations by incorporating temporal information to continuously update its models using behavioral features, specifically process resource utilization metrics. By doing so, the proposed models can incrementally adapt to emerging threats and detect zero-day malware effectively. Upon evaluating our approach against traditional batch algorithms, we find it effective in detecting zero-day malware. Moreover, we demonstrate its efficacy in scenarios with limited data availability, where traditional batch-based approaches often struggle to perform reliably.

翻译：云计算和物联网的快速发展显著增加了计算资源的互联程度，为恶意软件的快速传播创造了环境。为应对这一挑战，研究者越来越多地采用机器学习方法，通过行为（即动态）特征来识别恶意软件。然而，现有方法存在以下局限性：依赖大规模标注数据集、采用固定模型训练，且假设已训练模型能长期保持有效性——忽视了恶意软件持续演变的复杂性。因此，这些方法往往无法检测随时间自适应演变的恶意软件攻击。本文提出一种用于动态恶意软件检测的在线学习方法，通过整合时序信息，利用行为特征（特别是进程资源利用指标）持续更新模型，从而克服上述局限。该方法使模型能够逐步适应新兴威胁，有效检测零日恶意软件。通过与传统批量算法进行对比评估，我们发现该方法在零日恶意软件检测方面表现优异。此外，在数据可用性受限的场景中，传统批量方法往往难以稳定运行，而本文方法仍能保持良好检测效能。