Towards Accurate Run-Time Hardware-Assisted Stealthy Malware Detection: A Lightweight, yet Effective Time Series CNN-Based Approach

Abstract

According to recent security analysis reports, malicious software (a.k.a. malware) is rising at an alarming rate in numbers, complexity, and harmful purposes to compromise the security of modern computer systems. Recently, malware detection based on low-level hardware features (e.g., Hardware Performance Counters (HPCs) information) has emerged as an effective alternative solution to address the complexity and performance overheads of traditional software-based detection methods. Hardware-assisted Malware Detection (HMD) techniques depend on standard Machine Learning (ML) classifiers to detect signatures of malicious applications by monitoring built-in HPC registers during execution at run-time. Prior HMD methods though effective have limited their study on detecting malicious applications that are spawned as a separate thread during application execution, hence detecting stealthy malware patterns at run-time remains a critical challenge. Stealthy malware refers to harmful cyber attacks in which malicious code is hidden within benign applications and remains undetected by traditional malware detection approaches. In this paper, we first present a comprehensive review of recent advances in hardware-assisted malware detection studies that have used standard ML techniques to detect the malware signatures. Next, to address the challenge of stealthy malware detection at the processor’s hardware level, we propose StealthMiner, a novel specialized time series machine learning-based approach to accurately detect stealthy malware trace at run-time using branch instructions, the most prominent HPC feature. StealthMiner is based on a lightweight time series Fully Convolutional Neural Network (FCN) model that automatically identifies potentially contaminated samples in HPC-based time series data and utilizes them to accurately recognize the trace of stealthy malware. Our analysis demonstrates that using state-of-the-art ML-based malware detection methods is not effective in detecting stealthy malware samples since the captured HPC data not only represents malware but also carries benign applications’ microarchitectural data. The experimental results demonstrate that with the aid of our novel intelligent approach, stealthy malware can be detected at run-time with 94% detection performance on average with only one HPC feature, outperforming the detection performance of state-of-the-art HMD and general time series classification methods by up to 42% and 36%, respectively.

Enhancing EV Charging Station Security Using A Multi-dimensional Dataset : CICEVSE2024

“…Even though these works could be used for profiling EV charging sessions and to some extent, EV user behaviours, they however unlike our work, are not cybersecurity focused and hence cannot be used for detecting security attacks launched against the EVSE. Another associated area of study explores the application of hardware events for cybersecurity solutions, including device behavioral fingerprinting for anomaly detection [39,30,47] and malware classification [31,41,1]. However, the datasets used for most of these works are unavailable for further experiments and validation.…”

A Survey on Hardware-Based Malware Detection Approaches

“…They are valued for simplicity and practical application success, focusing on the relevancy of features. Prominent methods include Principal Component Analysis (PCA) (used by [47], [53], [79], [80]), Fisher Score [81] (used by [34], [51]), Pearson Correlation Coefficient [82] (used by [46]- [48], [79], [80]) and Information Gain (Mutual Information) [83] (used by [84], [85]). The Scikit-learn [86] library for the Python and Weka [87] are tools frequently used in the HMD field for FS.…”

Enhanced Classification of Heartbeat Electrocardiogram Signals Using a Long Short-Term Memory–Convolutional Neural Network Ensemble: Paving the Way for Preventive Healthcare

“…While CNNs are widely acknowledged for their proficiency in image processing, their utility extends beyond this domain. They are also capable of handling time series classification, thus demonstrating their versatility in handling different types of data [44,45]. CNNs can handle sequential data by treating it as a one-dimensional "image" and applying convolutional filters to extract local and global patterns, which can often be beneficial in time series analysis.…”