{
  "schema_version": "0.6.0",
  "paper_id": "malware-system-calls-detection-using-hybrid-system",
  "page_url": "https://naser.github.io/research-publications/papers/malware-system-calls-detection-using-hybrid-system/",
  "title": "Malware System Calls Detection Using Hybrid System",
  "title_variants": [],
  "authors": [
    "Yue Guan",
    "Naser Ezzati-Jivan"
  ],
  "author_details": [
    {
      "name": "Yue Guan",
      "orcid": null,
      "profile_url": "https://dblp.org/pid/54/7820.html"
    },
    {
      "name": "Naser Ezzati-Jivan",
      "orcid": "https://orcid.org/0000-0003-1435-6297",
      "profile_url": "https://naser.github.io/"
    }
  ],
  "publication": {
    "year": 2021,
    "venue": "2021 IEEE International Systems Conference (SysCon)",
    "type": "conference paper",
    "publication_date": "2021-04-15",
    "online_date": null,
    "print_date": "2021-04-15",
    "volume": null,
    "issue": null,
    "pages": "1-8",
    "article_number": null,
    "publisher": "IEEE",
    "issn": [],
    "isbn": [],
    "crossref_type": "proceedings-article"
  },
  "publication_type": "conference paper",
  "status": "published_with_public_full_text",
  "canonical_source_url": "https://doi.org/10.1109/SysCon48628.2021.9447094",
  "source_record_id": "malware-system-calls-detection-using-hybrid-system-a8de77c4ef",
  "identifiers": {
    "doi": "10.1109/SysCon48628.2021.9447094"
  },
  "abstract": null,
  "abstract_source": "Local published-paper PDF reviewed; abstract not reproduced.",
  "abstract_available": false,
  "scholar_eligibility": {
    "eligible": false,
    "basis": "not-eligible",
    "note": "The page is a discovery record; it does not claim Google Scholar article-host eligibility."
  },
  "description": "The paper combines LTTng system-call monitoring with recurrent and Transformer-style models for malware and anomalous system-behavior detection.",
  "evidence_level": "full-text-reviewed",
  "evidence": {
    "source_basis": "full-text-reviewed",
    "coverage": "material paper sections",
    "summary_origin": "AI-assisted catalog editorial summary",
    "review_status": "catalog-reviewed; paper-author approval pending",
    "verified_on": "2026-08-09",
    "sources": [
      {
        "note": "Malware system-call PDF: LTTng, message-queue aggregation, Trace Compass, normalized count vectors, LSTM/Transformer architecture, and baselines"
      },
      {
        "note": "Malware system-call PDF: VM/laboratory setup, approximately 45,000 samples, 28-process setup, 80/20 split, hyperparameters, precision/recall results"
      },
      {
        "note": "Malware system-call PDF: virtualization/generalization limitation, count-vector boundary, dropout inconsistency, and future work"
      },
      {
        "note": "Local PDF hash verified in pdf-evidence/notes/malware-system-calls-detection-using-hybrid-system.md and pdf-evidence/extraction-manifest.json"
      }
    ]
  },
  "summary": {
    "core_contribution": "The paper combines LTTng system-call monitoring with recurrent and Transformer-style models for malware and anomalous system-behavior detection.",
    "problem": "System-call anomaly detection must handle variable-length behavioral sequences, imbalanced anomaly data, and attacks that do not match known misuse patterns. Simple n-gram/count approaches can lose temporal behavior (pp. 1-2).",
    "method": "LTTng collects Linux system calls; a sliding window and message queue feed Trace Compass for collection/inspection. Variable-length sequences are converted to normalized fixed-length count vectors and batched per process. The model uses an LSTM followed by Transformer encoder blocks with multi-head attention, feed-forward layers, residual connections, layer normalization, and a linear classifier (pp. 3-5).",
    "findings": "The reported configuration achieves 92.6% precision and 93.8% recall; the table's strongest prior LSTM entry is 91.6%/92.2% (pp. 5-6). Experiments use multiple VMs on a host described as Intel Core i7 4 GHz, 8 CPUs, 64 GB RAM; the paper describes \"45k normal and anomalous\" samples but does not establish whether this is combined or per-class. A second client/server laboratory setup uses the top 28 processes and an 80/20 split (p. 5).",
    "limitations": "The evidence is laboratory/VM-based; production overhead, cross-OS behavior, and generalization to genuinely unseen malware families are not established. Count-vector preprocessing may discard within-sequence order; this is an analyst inference, not an author-stated limitation. The source reports dropout 0.8 for the model configuration but Transformer encoder dropout 0.1 (p. 5), an internal inconsistency.",
    "future_work": "Improve preprocessing and representation beyond plain count vectors; investigate GAN-based approaches for immunization/higher accuracy on unknown attacks; develop more informative anomaly representations (p. 7)."
  },
  "tags": [
    "kernel-tracing",
    "system-tracing",
    "anomaly-detection",
    "machine-learning",
    "observability"
  ],
  "keywords": [
    "malware detection",
    "system-call analysis",
    "LTTng",
    "Trace Compass",
    "LSTM",
    "Transformer",
    "multi-head attention",
    "PyTorch",
    "Linux VMs",
    "sequence classification",
    "precision",
    "recall",
    "unknown attacks"
  ],
  "versions": [
    {
      "id": "published-version",
      "label": "Published version",
      "relation": "version-of-record",
      "title": "Malware System Calls Detection Using Hybrid System",
      "url": "https://doi.org/10.1109/SysCon48628.2021.9447094",
      "pdf_url": null,
      "status": "published",
      "canonical_for_citation": true
    },
    {
      "id": "public-full-text-page",
      "label": "Public full-text page",
      "relation": "source-record",
      "title": "Malware System Calls Detection Using Hybrid System",
      "url": "https://www.researchgate.net/publication/352269632_Malware_System_Calls_Detection_Using_Hybrid_System",
      "pdf_url": null,
      "status": "public_full_text",
      "canonical_for_citation": false
    }
  ],
  "access": {
    "status": "published_with_public_full_text",
    "note": "The DOI is the canonical citation target; the public full-text or author-manuscript link is external and the PDF is not redistributed here.",
    "license": null
  },
  "resources": {
    "code": null,
    "data": null,
    "slides": null,
    "demo": null
  },
  "citation_guidance": {
    "when_to_cite": "Cite this paper when your work uses or compares a hybrid LSTM-Transformer architecture that combines recurrent modeling of sparse system-call sequences with Transformer global-dependency modeling.",
    "points": [
      "For a hybrid LSTM-Transformer architecture that combines recurrent modeling of sparse system-call sequences with Transformer global-dependency modeling.",
      "For LTTng-based collection and normalized system-call count-vector preprocessing in malware/anomaly detection.",
      "For the reported 92.6% precision / 93.8% recall comparison against classical, LSTM, BiLSTM, and Inception-like LSTM baselines, with the VM/lab scope stated."
    ],
    "canonical_version_id": "published-version"
  },
  "provenance": {
    "metadata_verified_on": "2026-08-09",
    "metadata_source": [
      "Malware system-call PDF: LTTng, message-queue aggregation, Trace Compass, normalized count vectors, LSTM/Transformer architecture, and baselines",
      "Malware system-call PDF: VM/laboratory setup, approximately 45,000 samples, 28-process setup, 80/20 split, hyperparameters, precision/recall results",
      "Malware system-call PDF: virtualization/generalization limitation, count-vector boundary, dropout inconsistency, and future work",
      "Local PDF hash verified in pdf-evidence/notes/malware-system-calls-detection-using-hybrid-system.md and pdf-evidence/extraction-manifest.json"
    ],
    "summary_written_by": "AI-assisted",
    "summary_verified_by": "full-text-grounded catalog review; author approval pending",
    "linked_preprint_record": null,
    "author_order_note": null
  },
  "batch": {
    "phase": 2,
    "batch_label": "expanded forty-paper release",
    "status": "included_in_expanded_catalog",
    "selected_at": "2026-08-09"
  }
}