I think people here could guide me in solving a problem related to anomaly detection. The term anomaly here refers to some malware attack.
I could get information about the malware infection from more than one source. For example extracting value from two different data strututres and if the value is different it is certain that virus infection is there.
In order to remove the false positive cases, information is gathered from different data strutres or mechanisms. In that certain information are less trusted and certain information are more trusted.
I am looking for a mathematical method, that could easily handle this type of situations?
Its applied in Linux Kernel for detecting some kind of anomalies. But the problem is that if the kernel is affected you cant trust anyone. But "some" behavior can tell you that anomaly is there. But some others not
Current models mainly depends on archived copy of the system before infection and then compare it with the new state. I am looking for some other method like
(1) Certain variables cant be accessed by a normal module (2) Information given by command should match (3) Module code didn't have any jmp instructions often
In these (3) is allowed to some extent. But (1) is disallowed. The (2) should certainly match.
Hope now things are clear.