2SMaRT: A Two-Stage Machine Learning-Based Approach for Run-Time Specialized Hardware-Assisted Malware Detection

Sayadi, Hossein; Makrani, Hosein Mohammadi; Dinakarrao, Sai Manoj Pudukotai; Mohsenin, Tinoosh; Sasan, Avesta; Rafatirad, Setareh; Homayoun, Houman

doi:10.23919/date.2019.8715080

Cited by 58 publications

(17 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The HPC registers are responsible to collect a myriad of low-level events such as cache access and misses, TLB hits and misses, branch mispredictions, etc. [18,22,30].…”

Section: Hardware Performance Countersmentioning

confidence: 99%

“…Performance counter registers are easily programmable across all platforms. Depending on the processor architecture, there are different numbers of HPC registers available [18,22,30]. For instance, the number of counter registers in the Intel Ivy-bridge and Intel Broadwell CPUs is limited to only four per processor core, meaning that only four HPCs can be captured simultaneously.…”

Section: Hardware Performance Countersmentioning

confidence: 99%

“…Recently, application areas of hardware performance counters are grown from mere performance analysis to detecting firmware modification in embedded systems [21], estimating system power consumption [40], and detection of malicious software at the hardware level [14,17,18,22] or even hardware trojans [41]. As a result, in this work, we have used the low-level information captured from HPC registers to identify the malicious patterns of applications by proposing effective and complexity-aware machine learningbased solutions addressing various critical challenges associated with run-time malware detection using microarchitectural features.…”

Section: Hardware Performance Countersmentioning

confidence: 99%

“…The recent work in [22] proposed a two-stage machine learning-based approach for run-time malware detection in which in the first level classifies applications using a multiclass classification technique into either benign or one of the malware classes (Virus, Rootkit, Backdoor, and Trojan). In the second level, to have a high detection performance, the authors deploy a machine learning model that works best for each class of malware and further apply effective ensemble learning to enhance the performance of malware detection.…”

Section: Hardware-assisted Malware Detectionmentioning

confidence: 99%

“…HMD methods reduce the latency of the detection process by order of magnitude with a small hardware overhead. In particular, recent studies have shown that malware can be differentiated from normal programs by classifying anomalies using Machine Learning (ML) techniques in low-level microarchitectural feature spaces captured by Hardware Performance Counters (HPCs) [4,[14][15][16][17][18][19][20][21][22] to appropriately represent the application behavior. The HPCs are special-purpose registers implemented into modern microprocessors to capture the trace of hardware-related events such as executed instructions, suffered cache-misses, or mispredicted branches for a running program [16,18,23].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Towards Accurate Run-Time Hardware-Assisted Stealthy Malware Detection: A Lightweight, yet Effective Time Series CNN-Based Approach

et al. 2021

Self Cite

View full text Add to dashboard Cite

According to recent security analysis reports, malicious software (a.k.a. malware) is rising at an alarming rate in numbers, complexity, and harmful purposes to compromise the security of modern computer systems. Recently, malware detection based on low-level hardware features (e.g., Hardware Performance Counters (HPCs) information) has emerged as an effective alternative solution to address the complexity and performance overheads of traditional software-based detection methods. Hardware-assisted Malware Detection (HMD) techniques depend on standard Machine Learning (ML) classifiers to detect signatures of malicious applications by monitoring built-in HPC registers during execution at run-time. Prior HMD methods though effective have limited their study on detecting malicious applications that are spawned as a separate thread during application execution, hence detecting stealthy malware patterns at run-time remains a critical challenge. Stealthy malware refers to harmful cyber attacks in which malicious code is hidden within benign applications and remains undetected by traditional malware detection approaches. In this paper, we first present a comprehensive review of recent advances in hardware-assisted malware detection studies that have used standard ML techniques to detect the malware signatures. Next, to address the challenge of stealthy malware detection at the processor’s hardware level, we propose StealthMiner, a novel specialized time series machine learning-based approach to accurately detect stealthy malware trace at run-time using branch instructions, the most prominent HPC feature. StealthMiner is based on a lightweight time series Fully Convolutional Neural Network (FCN) model that automatically identifies potentially contaminated samples in HPC-based time series data and utilizes them to accurately recognize the trace of stealthy malware. Our analysis demonstrates that using state-of-the-art ML-based malware detection methods is not effective in detecting stealthy malware samples since the captured HPC data not only represents malware but also carries benign applications’ microarchitectural data. The experimental results demonstrate that with the aid of our novel intelligent approach, stealthy malware can be detected at run-time with 94% detection performance on average with only one HPC feature, outperforming the detection performance of state-of-the-art HMD and general time series classification methods by up to 42% and 36%, respectively.

show abstract

“…The HPC registers are responsible to collect a myriad of low-level events such as cache access and misses, TLB hits and misses, branch mispredictions, etc. [18,22,30].…”

Section: Hardware Performance Countersmentioning

confidence: 99%

Section: Hardware Performance Countersmentioning

confidence: 99%