"The most successful defined pattern is constructed around the executions of Unix shell processes performed by malware." Syscall profiling will produce false p

"The most successful defined pattern is constructed around the executions of Unix shell processes performed by malware." Syscall profiling will produce false positives. For example, some installer that invokes the shell to perform some tasks it could have done via syscalls directly or indirectly though some higher level library. His benign applications only included a single third party program. (Office 2011) Moreover, it seems he only collected data from running the applications, not while installing them. If he had collected data while installing a lot of perfectly legitimate software he would have seen a lot of shell invocations. Syscall profiling will also fail to detect malicious code using techniques such as syscall proxying. I think the syscall hooking angle has already been done to death and has consistently failed to achieve significantly better results than signature based detection. It's a great technique for an expert to monitor a system with, but useless for the average user who will not be able to investigate whether or the cause of an alert is benign or malicious. [Edit: There's a bigger list of applications that were tested on page 91, listing which ones create false positives. It's unclear whether or not data was gathered during installation of these applications or just while running them]