Reduction of Classifier Size and Acceleration of Classification Algorithm in Malware Detection Mechanism Using Processor Information

Koike, Katsuya; Kobayashi, Ryota; Katoh, Masahiko

doi:10.1109/candarw.2019.00066

Cited by 3 publications

(8 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In November 2019, we presented a paper at the CANDAR Workshop that is an interim report of this paper [23]. The contributions of the interim report include the improvement of the operation efficiency and speed of Takase's mechanism [10].…”

Section: Relationship With Previous Studiesmentioning

confidence: 99%

IoT-oriented high-efficient anti-malware hardware focusing on time series metadata extractable from inside a processor core

Koike

Kobayashi

Katoh

2022

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

We aim to improve the efficiency of our previously proposed anti-malware hardware; it is a hardware-implemented malware detection mechanism that uses information inside the processor. We previously evaluated a prototype, but, due to its prototypical nature, there remain limitations, such as only detecting certain behaviors, high power consumption, and a tendency to bloat the training model. In this paper, we propose a circuit and a learning method to achieve high efficiency, low power consumption, and light weight for the model. In considering these three issues, we focus on time-series metadata obtained by transforming the processor information. To improve efficiency, we implement predictive detection to predict the behavior of metadata in the malware detection component. This lets the model detect malware within less than 19% of the number of execution cycles of the conventional method. To reduce power consumption, we implement a sampling circuit that interrupts the input to the detection circuit at regular intervals, reducing the system’s uptime by 99% while maintaining judgment accuracy. Finally, for a light weight, we focus on the training process of the metadata generator based on a machine-learning model. By applying sampling learning and feature dimensionality reduction in the training process, a metadata generator approximately 16% smaller than the previous version is created.

show abstract

Section: Relationship With Previous Studiesmentioning

confidence: 99%

IoT-oriented high-efficient anti-malware hardware focusing on time series metadata extractable from inside a processor core

Koike

Kobayashi

Katoh

2022

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Koike et al [13] proposed an MDM that runs in parallel with the CPU on LSI and uses processor information to detect malware. Similar work has been done on malware detection using register aggregates called hardware performance counters (HPC), which classify applications as either malware or benign [15].…”

Section: Related Workmentioning

confidence: 99%

“…This section gives an overview of the MDM proposed by Koike et al [13] and the HRTable proposed by Deguchi et al [12].…”

Section: Overview Of Mdm and Its Issuesmentioning

confidence: 99%

“…One of the reasons for the lack of anti-malware measures in IoT devices is that many anti-malware measures are designed to be implemented in software, whereas IoT devices have fewer hardware resources than personal computers and server devices. To realize anti-malware measures that can be implemented even in IoT devices with scarce hardware resources, a malware detection mechanism (MDM) based on hardware implementation was proposed by Koike et al [13]. The MDM consists of three hardware elements: an access-hit counter, three dividers, and a classifier.…”

Section: Introductionmentioning

confidence: 99%

“…It is proposed to operate on Large-Scale Integration (LSI). A hardware element called the Hit Rate Table (hereinafter referred to as the HRTable) was introduced to the proposed MDM and evaluated [13,12]. It is a mechanism that calculates the information obtained from the CPU (processor information) instead of the divider in the MDM.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Evaluation of implementability in a malware detection mechanism using processor information

Deguchi

Katoh

Kobayashi³

2022

IJNC

Self Cite

View full text Add to dashboard Cite

Currently, software implementation is the mainstream approach for anti-malware measures. However, software-based anti-malware measures are difficult to implement in Internet of Things devices with limited hardware resources. To solve this problem, a malware detection mechanism that can be realized with only hardware has been proposed. The hardware mechanism consists of three elements: an access-hit counter, dividers, and a classifier. The classifier is generated by a random forest and uses processor information as feature values. To reduce the hardware scale, a Hit Rate Table (HRTable) is introduced in place of the dividers. We propose methods of reducing the scale of hardware resources and synchronizing the CPU and the malware detection mechanism. This paper implements the proposed mechanism in hardware, simulates it while considering the delay caused by input/output to the HRTable, and evaluates the hardware scale of the proposed mechanism combined with RISC-V on a field-programmable gate array (FPGA).

show abstract

Evaluation of implementability in a malware detection mechanism using processor information

Deguchi

Katoh

Kobayashi

2021

2021 Ninth International Symposium on Computing and Networking Workshops (CANDARW)

View full text Add to dashboard Cite

Reduction of Classifier Size and Acceleration of Classification Algorithm in Malware Detection Mechanism Using Processor Information

Cited by 3 publications

References 7 publications

IoT-oriented high-efficient anti-malware hardware focusing on time series metadata extractable from inside a processor core

IoT-oriented high-efficient anti-malware hardware focusing on time series metadata extractable from inside a processor core

Evaluation of implementability in a malware detection mechanism using processor information

Evaluation of implementability in a malware detection mechanism using processor information

Contact Info

Product

Resources

About