Malware Detection from a Virtual Machine Correlating Unusual Keystrokes, Network Traffic, and Suspicious Registry Access

Current anti-virus malware detection methods focus on signature-based methods. Recent research has introduced new, effective methods of malware detection. First, recent research including cloud-based monitoring and analysis, joint network-host based methods, feature ranking, machine learning and kernel data structure invariant monitoring are reviewed. Second, virtual machine based malware detection is proposed. This method combines network traffic analysis through keystroke analysis and registry anomaly detection to detect malware. It correlates suspicious network activity with suspicious registry accesses in order to detect malware with a higher confidence and lower false positives. Keywords-keystroke analysis; malware detection; registry analysis; traffic analysis; virtual machine