A Supervised Topic Transition Model for Detecting Malicious System Call Sequences

We propose a probabilistic model for behavior-based mal- ware detection that jointly models sequential data and clas s labels. Given labeled sequences (harmless/malicious), ou r goal is to reveal behavior patterns and exploit them to pre- dict class labels of unknown sequences. The proposed model is a novel extension of supervised latent Dirichlet allocation with an estimation algorithm that alternates between Gibbs sampling and gradient descent. Experiments on real-world data set show that our model can learn meaningful patterns, and provides competitive performance on the malware detection task. Moreover, we parallelize the training algorithm and demonstrate scalability with varying numbers of processors.