Explainable Machine Learning for Intrusion Detection via Hardware Performance Counters

Kuruvila, Abraham Peedikayil; Meng, Xingyu; Kundu, Shamik; Pandey, Gaurav; Basu, Kanad

doi:10.1109/tcad.2022.3149745

Cited by 17 publications

(4 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Examples include Kuruvila et. al [57], an explainable HPC-based Double Regression machine learning framework that isolated the most malevolent transient window of an application on two malware and five microarchitectural side-channel attacks, as well as Pan et. al [58], a framework using explainable machine learning that combined HPCs and embedded trace buffers to detect and localize malicious behavior.…”

Section: Hpc-based Machine Learning Classificationmentioning

confidence: 99%

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Hill,

Owens Walker,

Blanco

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Ransomware is a type of malicious software designed to encrypt a user's important data for the purpose of extortion, with a global annual impact of billions of dollars in damages. This research proposes a side-channel-based ransomware detection method that utilizes the microarchitectural sidechannel accessed through hardware performance counters. Unlike most ransomware research, which relies on virtual machines to easily restore a system to its uncompromised, pre-encrypted state, this work leverages thousands of trials collected on hardware without the use of virtualization. Trials consist of both benign operations and real-world ransomware executables. Over two hundred distinct hardware events were collected on (non-virtualized) computer hardware to replicate the real-world scenario in which most ransomware attacks occur. Over 30 classifiers were systematically trained with each of the 200+ hardware events to reduce the number of classifiers and performance counters considered, and then five of the top classification algorithms were evaluated to rank which hardware performance counters contributed to best classification results. Overall, this work showed that classification of ransomware in under two seconds with over 95% accuracy is viable with as few as 3 hardware event features for the Neural Network and Bagged Tree classifiers.

show abstract

Section: Hpc-based Machine Learning Classificationmentioning

confidence: 99%

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Hill,

Owens Walker,

Blanco

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Tang et al rely on hardware performance counters and unsupervised machine learning for anomaly detection [37], while Bahador et al and Singh et al use support vector machines and decision trees to classify applications [38,39]. Kuruvila et al focus on an explainable machine-learning model for intrusion detection via hardware performance counters [40]. There are several approaches to detect CPU side-channel attacks based on machine learning [41][42][43].…”

Section: Related Workmentioning

confidence: 99%

Profiling with Trust: System Monitoring from Trusted Execution Environments

Eichler

Röckl

Jung

et al. 2023

Preprint

View full text Add to dashboard Cite

Large-scale attacks on IoT and edge computing devices pose a significant threat. As a prominent example, Mirai is an IoT botnet with 600,000 infected devices around the globe, capable of conducting effective and targeted DDoS attacks on (critical) infrastructure. Driven by the substantial impacts of attacks, manufacturers and system integrators propose Trusted Execution Environments (TEEs) that have gained significant importance recently. TEEs offer an execution environment to run small portions of code isolated from the rest of the system, even if the operating system is compromised. In this publication, we examine TEEs in the context of system monitoring and introduce the Trusted Monitor (TM), a novel anomaly detection system that runs within a TEE. The TM continuously profiles the system using hardware performance counters and utilizes an application-specific machine-learning model for anomaly detection. In our evaluation, we demonstrate that the TM accurately classifies 86% of 183 tested workloads, with an overhead of less than 2%. Notably, we show that a real-world kernel-level rootkit has observable effects on performance counters, allowing the TM to detect it. Major parts of the TM are implemented in the Rust programming language, eliminating common security-critical programming errors.

show abstract

“…While the existing approaches render promising outcomes, none of them were designed with explainability in mind. To overcome the issue of explainability in the area of hardware performance counter (HPC) -based intrusion detection, Kuruvila et al [116] propose an explainable HPC-based Double Regression (HPCDR) ML framework. The study examines two distinct types of attacks: microarchitectural and malware.…”

Section: ) Regressionmentioning

confidence: 99%

Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities

et al. 2022

View full text Add to dashboard Cite

The application of Artificial Intelligence (AI) and Machine Learning (ML) to cybersecurity challenges has gained traction in industry and academia, partially as a result of widespread malware attacks on critical systems such as cloud infrastructures and government institutions. Intrusion Detection Systems (IDS), using some forms of AI, have received widespread adoption due to their ability to handle vast amounts of data with a high prediction accuracy. These systems are hosted in the organizational Cyber Security Operation Center (CSoC) as a defense tool to monitor and detect malicious network flow that would otherwise impact the Confidentiality, Integrity, and Availability (CIA). CSoC analysts rely on these systems to make decisions about the detected threats. However, IDSs designed using Deep Learning (DL) techniques are often treated as black box models and do not provide a justification for their predictions. This creates a barrier for CSoC analysts, as they are unable to improve their decisions based on the model's predictions. One solution to this problem is to design explainable IDS (X-IDS). This survey reviews the state-of-the-art in explainable AI (XAI) for IDS, its current challenges, and discusses how these challenges span to the design of an X-IDS. In particular, we discuss black box and white box approaches comprehensively. We also present the tradeoff between these approaches in terms of their performance and ability to produce explanations. Furthermore, we propose a generic architecture that considers human-in-the-loop which can be used as a guideline when designing an X-IDS. Research recommendations are given from three critical viewpoints: the need to define explainability for IDS, the need to create explanations tailored to various stakeholders, and the need to design metrics to evaluate explanations.INDEX TERMS Explainable intrusion detection systems, explainable artificial intelligence, machine learning, deep learning, white box, black box, explainability, cybersecurity.

show abstract

Explainable Machine Learning for Intrusion Detection via Hardware Performance Counters

Cited by 17 publications

References 24 publications

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Profiling with Trust: System Monitoring from Trusted Execution Environments

Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities

Contact Info

Product

Resources

About