The code underlying the OP research: https://github.com/vivami/grey_fox https://github.com/vivami/grey_fox "The grey fox is a kernel extension for Mac OS X tha

The code underlying the OP research: https://github.com/vivami/grey_fox https://github.com/vivami/grey_fox "The grey fox is a kernel extension for Mac OS X that logs performed system calls by any process running on the system. Research for my master thesis required a dataset of all system calls performed by benign as well as malicious processes (malware). After analysis of the gathered datasets, several system call patterns that identified malware were extracted. " (disclaimer: I was one of the three professors on the msc thesis committee for this work)