Matches in SemOpenAlex for { <https://semopenalex.org/work/W3080678972> ?p ?o ?g. }
- W3080678972 abstract "Many users implicitly assume that software can only be exploited after it is installed. However, recent supply-chain attacks demonstrate that application integrity must be ensured during installation itself. We introduce SIGL, a new tool for detecting malicious behavior during software installation. SIGL collects traces of system call activity, building a data provenance graph that it analyzes using a novel autoencoder architecture with a graph long short-term memory network (graph LSTM) for the encoder and a standard multilayer perceptron for the decoder. SIGL flags suspicious installations as well as the specific installation-time processes that are likely to be malicious. Using a test corpus of 625 malicious installers containing real-world malware, we demonstrate that SIGL has a detection accuracy of 96%, outperforming similar systems from industry and academia by up to 87% in precision and recall and 45% in accuracy. We also demonstrate that SIGL can pinpoint the processes most likely to have triggered malicious behavior, works on different audit platforms and operating systems, and is robust to training data contamination and adversarial attack. It can be used with application-specific models, even in the presence of new software versions, as well as application-agnostic meta-models that encompass a wide range of applications and installers." @default.
- W3080678972 created "2020-09-01" @default.
- W3080678972 creator A5005580571 @default.
- W3080678972 creator A5020094804 @default.
- W3080678972 creator A5043535867 @default.
- W3080678972 creator A5047060039 @default.
- W3080678972 creator A5054561146 @default.
- W3080678972 creator A5054751297 @default.
- W3080678972 creator A5082251778 @default.
- W3080678972 creator A5086992948 @default.
- W3080678972 date "2020-08-26" @default.
- W3080678972 modified "2023-10-11" @default.
- W3080678972 title "SIGL: Securing Software Installations Through Deep Graph Learning" @default.
- W3080678972 cites W1519699895 @default.
- W3080678972 cites W1559528097 @default.
- W3080678972 cites W1581407678 @default.
- W3080678972 cites W1650881334 @default.
- W3080678972 cites W168132470 @default.
- W3080678972 cites W168564468 @default.
- W3080678972 cites W192671640 @default.
- W3080678972 cites W1973451694 @default.
- W3080678972 cites W1993370323 @default.
- W3080678972 cites W2009232481 @default.
- W3080678972 cites W2030858754 @default.
- W3080678972 cites W2040424958 @default.
- W3080678972 cites W2048465382 @default.
- W3080678972 cites W2064675550 @default.
- W3080678972 cites W2083391339 @default.
- W3080678972 cites W2114016378 @default.
- W3080678972 cites W2117202485 @default.
- W3080678972 cites W2118722179 @default.
- W3080678972 cites W2122646361 @default.
- W3080678972 cites W2122742966 @default.
- W3080678972 cites W2136452616 @default.
- W3080678972 cites W2142720090 @default.
- W3080678972 cites W2142753309 @default.
- W3080678972 cites W2151135920 @default.
- W3080678972 cites W2153579005 @default.
- W3080678972 cites W2155440239 @default.
- W3080678972 cites W2253675773 @default.
- W3080678972 cites W2294464288 @default.
- W3080678972 cites W2295705535 @default.
- W3080678972 cites W2396034850 @default.
- W3080678972 cites W2397699236 @default.
- W3080678972 cites W2482374127 @default.
- W3080678972 cites W2743104969 @default.
- W3080678972 cites W2759336060 @default.
- W3080678972 cites W2764040154 @default.
- W3080678972 cites W2767094836 @default.
- W3080678972 cites W2774688517 @default.
- W3080678972 cites W2882319491 @default.
- W3080678972 cites W2885157095 @default.
- W3080678972 cites W2902581740 @default.
- W3080678972 cites W2946576587 @default.
- W3080678972 cites W2947745012 @default.
- W3080678972 cites W2952531073 @default.
- W3080678972 cites W2962703433 @default.
- W3080678972 cites W2962756421 @default.
- W3080678972 cites W2962785074 @default.
- W3080678972 cites W2962904108 @default.
- W3080678972 cites W2963020213 @default.
- W3080678972 cites W2963232610 @default.
- W3080678972 cites W2963355447 @default.
- W3080678972 cites W2963404565 @default.
- W3080678972 cites W2963807402 @default.
- W3080678972 cites W2964230347 @default.
- W3080678972 cites W2969462252 @default.
- W3080678972 cites W2982895110 @default.
- W3080678972 cites W2984488829 @default.
- W3080678972 cites W2997404190 @default.
- W3080678972 cites W3011400958 @default.
- W3080678972 cites W3104097132 @default.
- W3080678972 cites W3105780912 @default.
- W3080678972 cites W3106390645 @default.
- W3080678972 cites W3153872861 @default.
- W3080678972 cites W47175211 @default.
- W3080678972 hasPublicationYear "2020" @default.
- W3080678972 type Work @default.
- W3080678972 sameAs 3080678972 @default.
- W3080678972 citedByCount "0" @default.
- W3080678972 crossrefType "posted-content" @default.
- W3080678972 hasAuthorship W3080678972A5005580571 @default.
- W3080678972 hasAuthorship W3080678972A5020094804 @default.
- W3080678972 hasAuthorship W3080678972A5043535867 @default.
- W3080678972 hasAuthorship W3080678972A5047060039 @default.
- W3080678972 hasAuthorship W3080678972A5054561146 @default.
- W3080678972 hasAuthorship W3080678972A5054751297 @default.
- W3080678972 hasAuthorship W3080678972A5082251778 @default.
- W3080678972 hasAuthorship W3080678972A5086992948 @default.
- W3080678972 hasConcept C108583219 @default.
- W3080678972 hasConcept C111919701 @default.
- W3080678972 hasConcept C119857082 @default.
- W3080678972 hasConcept C132525143 @default.
- W3080678972 hasConcept C146778888 @default.
- W3080678972 hasConcept C154945302 @default.
- W3080678972 hasConcept C2777904410 @default.
- W3080678972 hasConcept C38652104 @default.
- W3080678972 hasConcept C41008148 @default.
- W3080678972 hasConcept C541664917 @default.
- W3080678972 hasConcept C80444323 @default.