Hardware-Assisted Malware Detection and Localization using Explainable Machine Learning

Pan, Zhixin; Sheldon, Jennifer; Mishra, Prabhat

doi:10.1109/tc.2022.3150573

Cited by 17 publications

(5 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…al [57], an explainable HPC-based Double Regression machine learning framework that isolated the most malevolent transient window of an application on two malware and five microarchitectural side-channel attacks, as well as Pan et. al [58], a framework using explainable machine learning that combined HPCs and embedded trace buffers to detect and localize malicious behavior.…”

Section: Hpc-based Machine Learning Classificationmentioning

confidence: 99%

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Hill,

Owens Walker,

Blanco

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Ransomware is a type of malicious software designed to encrypt a user's important data for the purpose of extortion, with a global annual impact of billions of dollars in damages. This research proposes a side-channel-based ransomware detection method that utilizes the microarchitectural sidechannel accessed through hardware performance counters. Unlike most ransomware research, which relies on virtual machines to easily restore a system to its uncompromised, pre-encrypted state, this work leverages thousands of trials collected on hardware without the use of virtualization. Trials consist of both benign operations and real-world ransomware executables. Over two hundred distinct hardware events were collected on (non-virtualized) computer hardware to replicate the real-world scenario in which most ransomware attacks occur. Over 30 classifiers were systematically trained with each of the 200+ hardware events to reduce the number of classifiers and performance counters considered, and then five of the top classification algorithms were evaluated to rank which hardware performance counters contributed to best classification results. Overall, this work showed that classification of ransomware in under two seconds with over 95% accuracy is viable with as few as 3 hardware event features for the Neural Network and Bagged Tree classifiers.

show abstract

Section: Hpc-based Machine Learning Classificationmentioning

confidence: 99%

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Hill,

Owens Walker,

Blanco

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…It was included in this paragraph because it is tested on a Malware detection dataset. Pan et al [144], [145] in two related works propose a hardware-assisted malware detection framework developing a regression-based explainable Machine Learning algorithm. They apply a Decision Tree or Linear Regression to interpret the final result.…”

Section: ) Explainable Artificial Intelligence In Malware Detectionmentioning

confidence: 99%

Explainable Artificial Intelligence in CyberSecurity: A Survey

et al. 2022

View full text Add to dashboard Cite

Nowadays, Artificial Intelligence (AI) is widely applied in every area of human being's daily life. Despite the AI benefits, its application suffer from the opacity of complex internal mechanisms and doesn't satisfy by design the principles of Explainable Artificial Intelligence (XAI). The lack of transparency further exacerbates the problem in the field of Cybersecurity because entrusting crucial decisions to a system that cannot explain itself presents obvious dangers. There are several methods in the literature capable of providing explainability of AI results. Anyway, the application of XAI in Cybersecurity can be a doubleedged sword. It substantially improves the Cybersecurity practices but simultaneously leaves the system vulnerable to adversary attacks. Therefore, there is a need to analyze the state-of-the-art of XAI methods in Cybersecurity to provide a clear vision for future research. This study presents an in-depth examination of the application of XAI in Cybersecurity. It considers more than 300 papers to comprehensively analyze the main Cybersecurity application fields, like Intrusion Detection Systems,Malware detection, Phishing and Spam detection, BotNets detection, Fraud detection, Zero-Day vulnerabilities, Digital Forensics and Crypto-Jacking . Specifically, this study focuses on the explainability methods adopted or proposed in these fields, pointing out promising works and new challenges.

show abstract

“…A wide variety of models are proposed by researchers for classification of malwares, and each of them varies in terms of qualitative & quantitative performance metrics. For instance, work in [1,2,3] proposes use of call graphs, system calls, and explainable Artificial Intelligence (AI) methods for improving classification & localization performance under real-time cyber physical systems. Similar models are discussed in [4,5,6 [10], and Metamorphic Malware detection via Genetic Algorithm (MMGA) [11] are discussed by researchers.…”

Section: Literature Reviewmentioning

confidence: 99%

ACMFNN: Design of an augmented convolutional model for intelligent cross-domain malware localization via forensic neural networks

Pateriya

Tomar

2022

Preprint

View full text Add to dashboard Cite

Classification of malwares from spatial & temporal data patterns requires efficient design of deep learning models. These models deploy methods for feature extraction, feature selection, classification & post-processing to perform this task. A wide variety of high-efficiency malware analysis models are proposed by researchers, and most of them are application-specific, thus cannot be scaled to multiple domains. Out of these, only a few of these models are targeted towards identification of malware locations. In order to improve malware detection scalability, and localization performance, this text proposes a novel augmented convolutional model (ACM) for intelligent cross-domain malware analysis via forensic neural networks (FNNs). The FNNs are designed as an integration of multiple augmented convolutional models, which include different optimizers & feature extraction units. In this design, each of these units are customized to improve their feature extraction & selection capabilities, which assists in improving classification performance. Results of classification are given to an ACM layer, which performs feature augmentation to localize malware positions in input data. The proposed model was evaluated on multiple malware datasets, including Electro RAT, Pegasus, SkyGoFree, Viking Horde, Bat Skull, Yesmile, Wirenet, Jigsaw, Satana, Tapaoux, etc. It was observed that the proposed model was able to classify these malwares with an average accuracy of 98.5%, which makes it useful for real-time malware analysis. The model was also able to achieve an average localization accuracy of 79.6% across these datasets, thereby assisting forensic experts to obtain an approximate estimate of malware locations in input data streams. This performance was compared with some of the recently proposed malware detection models, and it was observed that the proposed ACMFNN method has 8% better precision, 6.5% better recall, and 9.4% better classification accuracy when compared with these methods on the same dataset. Due to augmented convolutional model, it was observed that the proposed approach had 15% better localization accuracy, 19% better localization precision, and 14% better localization recall when compared with these methods. Thereby indicating that the propose model is applicable for a wide variety of malware detection & localization application deployments.

show abstract

Hardware-Assisted Malware Detection and Localization using Explainable Machine Learning

Cited by 17 publications

References 26 publications

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Explainable Artificial Intelligence in CyberSecurity: A Survey

ACMFNN: Design of an augmented convolutional model for intelligent cross-domain malware localization via forensic neural networks

Contact Info

Product

Resources

About