Abstract: Provided herein are systems and methods for detecting unknown portable executable (PE) malware utilizing dynamic analysis and temporal patterns. More specifically, the systems and methods provided herein utilize active learning. for enhanced detection of malware in the short and long term based on dynamic analysis and temporal patterns.

Abstract: A method for detection of unknown malware in Linux cloud environment, the method including: within a hypervisor, acquiring a raw data set comprising one or more volatile memory dumps of a Linux cloud server, wherein the volatile memory dumps are associated with a current state of the virtual machine's volatile memory, extracting one or more features from the raw data set (either by utilizing knowledge based features or by utilizing Deep Learning CNN architectures), and classifying, using at least one classifier, the one or more features, to determine if one or more of the features are associated with a malware, thereby detecting malware in a Linux cloud environment and distinguishing between a benign or malicious state of the server.