Performance Monitoring Counter Based Intelligent Malware Detection and Design Alternatives

Abstract

Hardware solutions for malware detection are becoming increasingly important as softwarebased solutions can be easily compromised by intelligent malware. However, the cost of hardware solutions including design complexity and dynamic power consumption cannot be ignored. Many of the existing hardware solutions are based on statistical learning blocks with abnormal features of system calls, network traffics, or processor behaviors. Among those solutions, the performance of the learning techniques relies primarily on the quality of the training data. However, for the processor behavior-based solutions, only a few behavioral events can be monitored simultaneously due to the limited number of PMCs (Performance Monitoring Counters) in a processor. As a result, the quality and quantity of the data obtained from architectural features have become a critical issue for PMC-based malware detection. In this paper, to emphasize the importance of selecting architectural features for malware detection, the statistical differences between malware workloads and benign workloads were characterized based on the information from performance counters. Most malware can easily be detected with basic characteristics, but some malware types are statistically very similar to benign workloads which need to be handled more in-depth. Hence, we focus on multiple steps to investigate critical issues of PMC-based malware detection: (i) statistical characterization of malware; (ii) distribution-based feature selection; (iii) trade-off analysis of detection time and accuracy; and (iv) providing architectural design alternatives for hardware-based malware detection. Our results show that the existing number of performance counters is not enough to achieve the desired accuracy. For more accurate malware detection in real-time, we propose both accuracy improvement schemes (with additional PMCs, etc.) and hardware acceleration schemes. Both schemes provide accuracy improvement (5~10%) and detection speedup (up to 10%) with the additional hardware cost (less than 1% of the chip complexity).

Chasing spammers: Using the Internet protocol address for detection

“…However, no procedure is perfect. In line with what Pattee et al (2022) point out regarding malware detection, most software can easily be detected by means of simple checks, but some are very similar to benign code and need to be handled more thoroughly.…”

“…These results are in line with previous findings (Waggoner et al, 2019) and with the fact that a small number of sources tend to generate large amounts of fake news (Allcott & Gentzkow, 2017; Axelrod & Hamilton, 1981). This is particularly relevant for businesses operating in online environments, such as social networks, e‐commerce platforms, and online service providers, as the identification of spammers’ profiles can enable the implementation of specific security protocols and antifraud algorithms that target certain groups (Pattee et al, 2022). That is, algorithms for identifying IP duplication could provide a list of IP addresses suspected of harboring spammers.…”

Low Resource and Power Consumption and Improved Classification Accuracy for IoT Implementation of a Malware Detection Mechanism using Processor Information

“…Pattee et al proposed a mechanism to complete the flow of hardware event collection, conversion of events to metadata for use in discrimination, and malware detection on the hardware, similar to our proposed MDM [22].…”

Classification of malware using multinomial linked latent modular double q learning

“…However, the more detailed architectural design for a dedicated accelerator provided efficiencies better for chip area, power, and processing time was required to be investigated. [30] 3.17 --Malware based on behavior chains [31] -90s -PMC-based malware detection [35] 12.5 6.825ms -MALDC [36] -20s 10% Proposed MLLD-MDQL 12.85 25.525ms 60-600kB…”

“…The results showed that the developed model improved the accuracy for the effective classification but failed to discover the new malware effectivel and thus, Pattee et al [35] developed an intelligent malware detection and design alternatives for performance monitoring counter. The developed model improved the importance of selecting the features for malware detection that showed statistical differences among the malware workloads and benign workloads were characterized on the basis of information from counters performances.…”