Analysing malware is important to understand how malicious software works and
to develop appropriate detection and prevention methods. Dynamic analysis can
overcome evasion techniques commonly used to bypass static analysis and provide
insights into malware runtime activities. Much research on dynamic analysis
focused on investigating machine-level information (e.g., CPU, memory, network
usage) to identify whether a machine is running malicious activities. A
malicious machine does not necessarily mean all running processes on the
machine are also malicious. If we can isolate the malicious process instead of
isolating the whole machine, we could kill the malicious process, and the
machine can keep doing its job. Another challenge dynamic malware detection
research faces is that the samples are executed in one machine without any
background applications running. It is unrealistic as a computer typically runs
many benign (background) applications when a malware incident happens. Our
experiment with machine-level data shows that the existence of background
applications decreases previous state-of-the-art accuracy by about 20.12% on
average. We also proposed a process-level Recurrent Neural Network (RNN)-based
detection model. Our proposed model performs better than the machine-level
detection model; 0.049 increase in detection rate and a false-positive rate
below 0.1.

分析恶意软件的重要性在于理解恶意软件的工作原理并开发适当的检测和预防方法。通过动态分析可以克服常用的规避静态分析的技术，并提供关于恶意软件运行时活动的见解。我们提出了一个基于进程级别的循环神经网络（RNN）检测模型，该模型相较于基于机器级别的检测模型有更好的性能。