Malware Detection at the Microarchitecture Level using Machine Learning Techniques

TL;DR

This paper evaluates various machine learning algorithms for malware detection at the microarchitecture level using Hardware Performance Counters, highlighting that lightweight models like J48 and JRip outperform complex ones in robustness.

Contribution

It provides a comprehensive comparison of ML algorithms for hardware-based malware detection, emphasizing the effectiveness of lightweight classifiers in multi-class scenarios.

Findings

J48 and JRip outperform complex models in robustness

Lightweight classifiers maintain high AUC with multiple malware types

Binary classification is less effective than multi-class in this context

Abstract

Detection of malware cyber-attacks at the processor microarchitecture level has recently emerged as a promising solution to enhance the security of computer systems. Security mechanisms, such as hardware-based malware detection, use machine learning algorithms to classify and detect malware with the aid of Hardware Performance Counters (HPCs) information. The ML classifiers are fed microarchitectural data extracted from Hardware Performance Counters (HPCs), which contain behavioral data about a software program. These HPCs are captured at run-time to model the program's behavior. Since the amount of HPCs are limited per processor, many techniques employ feature reduction to reduce the amount of HPCs down to the most essential attributes. Previous studies have already used binary classification to implement their malware detection after doing extensive feature reduction. This results in a simple identification of software being either malware or benign. This research comprehensively analyzes different hardware-based malware detectors by comparing different machine learning algorithms' accuracy with binary and multi-class classification models. Our experimental results indicate that when compared to complex machine learning models (e. g. Neural Network and Logistic), light-weight J48 and JRip algorithms perform better in detecting the malicious patterns even with the introduction of multiple types of malware. Although their detection accuracy slightly lowers, their robustness (Area Under the Curve) is still high enough that they deliver a reasonable false positive rate.