{'fraction_non_alphanumeric': 0.015710919088766692, 'fraction_numerical': 0.0, 'mean_word_length': 5.214634146341464, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Realization of dynamic behavior using remotely verifiable n-call slides in Unix process execution trace

Trusted computing presents a technique called remote attestation which helps in verifying the trustworthiness of a client's system. Generally known and mostly used methods to verify a target system's integrity are mostly static in nature. For the purpose of mitigating this problem many approaches have been presented. However, none of these are feasible either because of implementation complexity or because of an unrealistically high bandwidth requirement. In this paper, we propose STIDE-R, an approach that utilizes the concepts of the seminal work presented by STIDE -- a technique that measures the behavior of an application based on the sequence of system calls made. We focus on how to shorten the length of data that needs to be reported to the challenger. The principle advantage achieved is detection of zero-day malware at a remote system without incurring infeasible performance overhead. Further, the proposed architecture considers two dimensions as the most important for successful implementation of dynamic behavior attestation. These are to minimize the processing time on the target remote platform and to tackle the network overhead efficiently.