Towards Malware Detection via CPU Power Consumption: Data Collection Design and Analytics

Abstract

This paper presents an experimental design and data analytics approach aimed at power-based malware detection on general-purpose computers. Leveraging the fact that malware executions must consume power, we explore the postulate that malware can be accurately detected via power data analytics. Our experimental design and implementation allow for programmatic collection of CPU power profiles for fixed tasks during uninfected and infected states using five different rootkits. To characterize the power consumption profiles, we use both simple statistical and novel, sophisticated features. We test a one-class anomaly detection ensemble (that baselines non-infected power profiles) and several kernel-based SVM classifiers (that train on both uninfected and infected profiles) in detecting previously unseen malware and clean profiles. The anomaly detection system exhibits perfect detection when using all features and tasks, with smaller false detection rate than the supervised classifiers. The primary contribution is the proof of concept that baselining power of fixed tasks can provide accurate detection of rootkits. Moreover, our treatment presents engineering hurdles needed for experimentation and allows analysis of each statistical feature individually. This work appears to be the first step towards a viable power-based detection capability for general-purpose computers, and presents next steps toward this goal.

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

“…A typical example of the use of energy-based mechanisms is [113], which experimentally confirms that many rootkits change the CPU power profile. This trait can be used to detect the attack via specific time series-based algorithms.…”

ULTRA: Ultimate Rootkit Detection over the Air

“…[37] described a network time analysis approach for monitoring performance changes caused by hardware virtualization, with the goal of detecting the hardware virtualization rootkit. [11,39] identify rootkits by using power-based malware detection on general-purpose computers and [19,39,61] use machine learning (ML) and deep learning (DL) to perform a behavioral detection method based on CPU power consumption. Gibraltar [6] and Copilot [49] leverage direct memory access (DMA) via physical PCI to separately detect rootkit in kernel memory from another machine.…”

A Cyber-Physical System to Detect IoT Security Threats of a Smart Home Heterogeneous Wireless Sensor Node

“…Bridges et al [43] have shown that profiling of device power is a viable approach. They found that by directly monitoring the power usage of a CPU that an accurate power profile could be constructed.…”