A Fast Edge-End Threat Disposal Method Based on Kernel Probes and Lightweight Random Forest

Aiming at the zombie Trojan horse, ransomware virus, and other attacks faced by grid-side devices, the traditional endpoint detection and response program has problems such as insufficient privileges, low detection efficiency, and incomplete disposal. We propose a rapid threat disposal method based on kernel probes and random forests, which realizes process chain tracking and memory-resident malware removal by loading the operating system kernel driver and granting the probes systemlevel privileges. The Lightweight Random Forest (LRF) model is designed to identify the attack types in real time by combining multi-dimensional features such as process behavior and file operation. Simulation results show that the detection accuracy of this method for typical attacks such as zombie Trojans and ransomware viruses exceeds 95 %, the single-sample recognition time is as low as 8.7 ms, the average time consumed for threat disposal is shortened to <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\text{1. 2}$</tex> seconds, and the memory footprint is reduced to less than 10 MB, which significantly enhances the realtime protection capability of the grid-side equipment.