Ensemble Learning for Effective Run-Time Hardware-Based Malware Detection: A Comprehensive Analysis and Classification

Sayadi, Hossein; Patel, Nisarg; P.D., Sai Manoj; Sasan, Avesta; Rafatirad, Setareh; Homayoun, Houman

doi:10.1109/dac.2018.8465828

Cited by 81 publications

(60 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…MCS is the combination of a set of classifiers to produce a better prediction. MCS employs various decision combination strategies that are able to produce a more robust, reliable, efficient recognition and accurate classification [55]- [59]. There are three combination strategies when employing MCS: (i) sequential combination, (ii) parallel combination, and (iii) hybrid combination.…”

Section: Multiple Classifiers System (Mcs)mentioning

confidence: 99%

A Multiple Classifiers System for Anomaly Detection in Credit Card Data With Unbalanced and Overlapped Classes

Kalid

Tong

et al. 2020

IEEE Access

View full text Add to dashboard Cite

Frauds and default payments are two major anomalies in credit card transactions. Researchers have been vigorously finding solutions to tackle them and one of the solutions is to use data mining approaches. However, the collected credit card data can be quite a challenge for researchers. This is because of the data characteristics that contain: (i) unbalanced class distribution, and (ii) overlapping of class samples. Both characteristics generally cause low detection rates for the anomalies that are minorities in the data. On top of that, the weakness of general learning algorithms contributes to the difficulties of classifying the anomalies as the algorithms generally bias towards the majority class samples. In this study, we used a Multiple Classifiers System (MCS) on these two data sets: (i) credit card frauds (CCF), and (ii) credit card default payments (CCDP). The MCS employs a sequential decision combination strategy to produce accurate anomaly detection. Our empirical studies show that the MCS outperforms the existing research, particularly in detecting the anomalies that are minorities in these two credit card data sets. INDEX TERMS Anomaly detection, credit card, multiple classifiers.

show abstract

Section: Multiple Classifiers System (Mcs)mentioning

confidence: 99%

A Multiple Classifiers System for Anomaly Detection in Credit Card Data With Unbalanced and Overlapped Classes

Kalid

Tong

et al. 2020

IEEE Access

View full text Add to dashboard Cite

show abstract

“…There also exist traditional approaches such as semantic [28], [29], [30] and signaturebased [31], [32], [33] solutions including off-the-shelf antiviruses as well. However, most of these techniques are slow, and require large computational resources and memory [34], [35], [36], [37], making them infeasible to be adopted in IoT and resource constrained devices. Furthermore, the emergence of new malware threats often requires patching or updating off-the-shelf software-based malware detection solutions (such as anti-virus) and incurs a large amount of memory, hardware resources, as well as network communication bandwidth.…”

Section: ) Limited Resource Availabilitymentioning

confidence: 99%

Cognitive and Scalable Technique for Securing IoT Networks Against Malware Epidemics

et al. 2020

Self Cite

View full text Add to dashboard Cite

The sheer volume of IoT networks being deployed today presents a major "attack surface" and poses significant security risks at a scale never encountered before. In other words, a single IoT device/node that gets infected with malware has the potential to spread the malicious activities across the network, eventually ceasing the network functionality or compromising the network. Simply detecting and quarantining the malware in IoT networks does not guarantee preventing malware propagation. On the other hand, use of traditional control theory for malware confinement is not effective, as most of the existing works do not consider real-time malware control strategies that can be implemented using uncertain infection information from the nodes in the network or have the containment problem decoupled from network performance. In response, in this work, we propose a two-pronged approach with malware detection at nodelevel, and confinement of malware at network-level. We deploy a recently proposed lightweight runtime malware detector at the node-level that employs Hardware Performance Counter (HPC) values for malware detection. This node-level malware information is combined with the malware propagation information and then fed during runtime to a stochastic predictive controller to confine the malware propagation without hampering the network performance. Synthesizing the node-level malware information with the model predictive containment strategy leads to achieving an average network throughput of nearly 200% of that of IoT network without any defense, and up to 160% of that of network with commonly employed state-ofthe-art heuristic approaches for malware confinement. Furthermore, to scale with ever-increasing network topology sizes, we introduce a novel multi-attribute graph translation that can predict the network topology and node state information when provided with a snapshot of topology and node-level malware infection. The proposed multi-attribute graph translation has <5.88 Root Mean Square Error (RMSE) compared to the model predictive containment strategy and has shown nearly constant graph translation time and limited resource utilization independent of the network size.

show abstract

“…Comprehensive analysis of diverse classifiers for SCAs detection is important as each could yield different performance (in terms of accuracy, false positive rate, computational complexity, etc.) [32,34].…”

Section: Comprehensive Study Of Machine Learning Classifiersmentioning

confidence: 99%

Hybrid-shield

Wang

Sayadi

Sasan

et al. 2020

Proceedings of the 39th International Conference on Computer-Aided Design

Self Cite

View full text Add to dashboard Cite

Ensemble Learning for Effective Run-Time Hardware-Based Malware Detection: A Comprehensive Analysis and Classification

Cited by 81 publications

References 7 publications

A Multiple Classifiers System for Anomaly Detection in Credit Card Data With Unbalanced and Overlapped Classes

A Multiple Classifiers System for Anomaly Detection in Credit Card Data With Unbalanced and Overlapped Classes

Cognitive and Scalable Technique for Securing IoT Networks Against Malware Epidemics

Hybrid-shield

Contact Info

Product

Resources

About