An Accurate Tool for Modeling, Fingerprinting, Comparison, and Clustering of Parallel Applications Based on Performance Counters

Ramos, Vitor; Valderrama, Carlos; Xavier‐de‐Souza, Samuel; Manneback, Pierre

doi:10.1109/ipdpsw.2019.00130

Cited by 7 publications

(3 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…web browser, text editor, image viewer, audio player) based on intrinsic behavior. Ramos et al [41] developed an HPC-based tool to model, fingerprint, and compare behavior of applications for later classification. While neither of these tools were directly tested on malware, the application of HPCs to malicious behavior is a logical extension.…”

Section: Hardware Performance Counters In Malware and Ransomware Dete...mentioning

confidence: 99%

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Hill,

Owens Walker,

Blanco

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Ransomware is a type of malicious software designed to encrypt a user's important data for the purpose of extortion, with a global annual impact of billions of dollars in damages. This research proposes a side-channel-based ransomware detection method that utilizes the microarchitectural sidechannel accessed through hardware performance counters. Unlike most ransomware research, which relies on virtual machines to easily restore a system to its uncompromised, pre-encrypted state, this work leverages thousands of trials collected on hardware without the use of virtualization. Trials consist of both benign operations and real-world ransomware executables. Over two hundred distinct hardware events were collected on (non-virtualized) computer hardware to replicate the real-world scenario in which most ransomware attacks occur. Over 30 classifiers were systematically trained with each of the 200+ hardware events to reduce the number of classifiers and performance counters considered, and then five of the top classification algorithms were evaluated to rank which hardware performance counters contributed to best classification results. Overall, this work showed that classification of ransomware in under two seconds with over 95% accuracy is viable with as few as 3 hardware event features for the Neural Network and Bagged Tree classifiers.

show abstract

Section: Hardware Performance Counters In Malware and Ransomware Dete...mentioning

confidence: 99%

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Hill,

Owens Walker,

Blanco

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Additionally, there are cases where events need multiplexing, for example, when using more hardware events than the CPU can provide. There are also some well know problems regarding the precision of some events, as shown in many studies [20][21][22][23][24][25]. Some events that should be exact and deterministic (such as the number of executed instructions) show run-to-run variations and over-count on various architectures, even when running in strictly controlled environments.…”

Section: Related Workmentioning

confidence: 99%

Analytical Energy Model Parametrized by Workload, Clock Frequency and Number of Active Cores for Share-Memory High-Performance Computing Applications

et al. 2022

Self Cite

View full text Add to dashboard Cite

Energy consumption is crucial in high-performance computing (HPC), especially to enable the next exascale generation. Hence, modern systems implement various hardware and software features for power management. Nonetheless, due to numerous different implementations, we can always push the limits of software to achieve the most efficient use of our hardware. To be energy efficient, the software relies on dynamic voltage and frequency scaling (DVFS), as well as dynamic power management (DPM). Yet, none have privileged information on the hardware architecture and application behavior, which may lead to energy-inefficient software operation. This study proposes analytical modeling for architecture and application behavior that can be used to estimate energy-optimal software configurations and provide knowledgeable hints to improve DVFS and DPM techniques for single-node HPC applications. Additionally, model parameters, such as the level of parallelism and dynamic power, provide insights into how the modeled application consumes energy, which can be helpful for energy-efficient software development and operation. This novel analytical model takes the number of active cores, the operating frequencies, and the input size as inputs to provide energy consumption estimation. We present the modeling of 13 parallel applications employed to determine energy-optimal configurations for several different input sizes. The results show that up to 70% of energy could be saved in the best scenario compared to the default Linux choice and 14% on average. We also compare the proposed model with standard machine-learning modeling concerning training overhead and accuracy. The results show that our approach generates about 10 times less energy overhead for the same level of accuracy.

show abstract

“…They discussed the potential of clusters for application identification but did not evaluate their solution from this perspective. Ramos et al [8] relied on performance counters to cluster similar applications. The authors noted that the same application is sometimes present in multiple clusters, caused by input sizes changing application characteristics or specific input sizes only triggering specific parts of the code, thus altering application behavior.…”

Section: Related Workmentioning

confidence: 99%

An Execution Fingerprint Dictionary for HPC Application Recognition

Thomas¹,

Lachiche²,

Cavelan³

et al. 2021

Preprint

View full text Add to dashboard Cite

Applications running on HPC systems waste time and energy if they: (a) use resources inefficiently, (b) deviate from allocation purpose (e.g. cryptocurrency mining), or (c) encounter errors and failures. It is important to know which applications are running on the system, how they use the system, and whether they have been executed before. To recognize known applications during execution on a noisy system, we draw inspiration from the way Shazam recognizes known songs playing in a crowded bar. Our contribution is an Execution Fingerprint Dictionary (EFD) that stores execution fingerprints of system metrics (keys) linked to application and input size information (values) as key-value pairs for application recognition. Related work often relies on extensive system monitoring (many system metrics collected over large time windows) and employs machine learning methods to identify applications. Our solution only uses the first 2 minutes and a single system metric to achieve F-scores above 95 percent, providing comparable results to related work but with a fraction of the necessary data and a straightforward mechanism of recognition.

show abstract

An Accurate Tool for Modeling, Fingerprinting, Comparison, and Clustering of Parallel Applications Based on Performance Counters

Cited by 7 publications

References 7 publications

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Analytical Energy Model Parametrized by Workload, Clock Frequency and Number of Active Cores for Share-Memory High-Performance Computing Applications

An Execution Fingerprint Dictionary for HPC Application Recognition

Contact Info

Product

Resources

About