{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/a-planning-approach-to-monitoring-behavior-of","title":"A Planning Approach to Monitoring Behavior of Computer Programs","arxiv_id":"1709.03363","date":"2017-09-11","proceeding":null,"authors":["Alexandre Cukier","Ronen I. Brafman","Yotam Perkal","David Tolpin"],"abstract":"We describe a novel approach to monitoring high level behaviors using\nconcepts from AI planning. Our goal is to understand what a program is doing\nbased on its system call trace. This ability is particularly important for\ndetecting malware. We approach this problem by building an abstract model of\nthe operating system using the STRIPS planning language, casting system calls\nas planning operators. Given a system call trace, we simulate the corresponding\noperators on our model and by observing the properties of the state reached, we\nlearn about the nature of the original program and its behavior. Thus, unlike\nmost statistical detection methods that focus on syntactic features, our\napproach is semantic in nature. Therefore, it is more robust against\nobfuscation techniques used by malware that change the outward appearance of\nthe trace but not its effect. We demonstrate the efficacy of our approach by\nevaluating it on actual system call traces.","url_abs":"http://arxiv.org/abs/1709.03363v1","url_pdf":"http://arxiv.org/pdf/1709.03363v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"a-planning-approach-to-monitoring-behavior-of","repo_url":"https://github.com/alexEnsimag/planning-for-syscall-monitoring","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"none","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}