In recent years, the demand for Internet of Things (IoT) devices has increased dramatically. They are used in a variety of applications, such as sensors, in-vehicle terminals, control devices in factories, and medical equipment in hospitals. However, attackers are also increasingly targeting IoT devices, making it necessary to implement security countermeasures. However, IoT devices rarely have sufficient resources like high-end products such as PCs and servers. Therefore, we are developing a system that can detect malware with lower resources. In this study focusing on targeting the RISC-V architecture, we measure the classification accuracy of a detection mechanism using random forests and reduce the circuit scale and power consumption. We show that the detection mechanism can be made more accurate in classifying normal programs and malware and cost of the detection mechanism can be reduced.