Spatial and temporal convolution networks for system calls based process monitoring

A method, comprising:

• providing count vectors each having a plurality of components as input to a temporal convolution neural network and a spatial convolution neural network, wherein a count vector in the count vectors includes data representing system calls made by a process to an operating system during a configurable time interval, the data stored in a plurality of components of the count vector, wherein each component in the plurality of components corresponds to a type of system call in the system calls and number of times the type of system call occurred during the configurable time interval;
• generating, by passing the count vectors through a plurality of temporal filters in the temporal convolution neural network, a temporal output;
• generating, by passing the count vectors through a plurality of spatial filters in the spatial convolution neural network, a spatial output;
• merging the temporal output and the spatial output into a summary representation, wherein the summary representation represents the process that generated the count vectors;
• determining, using the summary representation of the count vectors, at least one process candidate for the process;
• and
• identifying the process that generated the count vectors using the at least one process candidate.

A malware detection system, comprising:

• a non-transitory memory storing instructions;
• and
• one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising:
• generating, by a process, a plurality of count vectors each having a plurality of components, wherein a count vector in the count vectors stores information that corresponds to system calls generated by processes and each component in the plurality of components of the count vector corresponds to a type of system call and a number of times the type of system call occurred in a configurable time interval;
• processing, using a plurality of filters in a temporal convolution neural network, the plurality of count vectors, wherein the processing generates a temporal output that represents temporal features of the process;
• processing, using a plurality of filters in a spatial convolution neural network, the plurality of count vectors, wherein the processing generates a spatial output that represents spatial features of the process;
• merging the temporal output and the spatial output into a summary representation, wherein the summary representation represents the process that generated the count vectors;
• and
• determining, using the summary representation, the process as a malicious process.