Learning Fast and Slow: PROPEDEUTICA for Real-time Malware Detection
  Existing malware detectors on safety-critical devices have difficulties in
runtime detection due to the performance overhead. In this paper, we introduce
PROPEDEUTICA, a framework for efficient and effective real-time malware
detection, leveraging the best of conventional machine learning (ML) and deep
learning (DL) techniques. In PROPEDEUTICA, all software start execution are
considered as benign and monitored by a conventional ML classifier for fast
detection. If the software receives a borderline classification from the ML
detector (e.g. the software is 50% likely to be benign and 50% likely to be
malicious), the software will be transferred to a more accurate, yet
performance demanding DL detector. To address spatial-temporal dynamics and
software execution heterogeneity, we introduce a novel DL architecture
(DEEPMALWARE) for PROPEDEUTICA with multi-stream inputs. We evaluated
PROPEDEUTICA with 9,115 malware samples and 1,338 benign software from various
categories for the Windows OS. With a borderline interval of [30%-70%],
PROPEDEUTICA achieves an accuracy of 94.34% and a false-positive rate of 8.75%,
with 41.45% of the samples moved for DEEPMALWARE analysis. Even using only CPU,
PROPEDEUTICA can detect malware within less than 0.1 seconds.
