Towards Robust Real-Time Hardware-based Mobile Malware Detection using Multiple Instance Learning Formulation

TL;DR

This paper presents RT-HMD, a hardware-based mobile malware detection system that employs Multiple Instance Learning to improve accuracy by addressing mislabeling issues in real-time analysis.

Contribution

It introduces a novel MIL-based approach with a Malicious Discriminative Score to enhance malware detection accuracy in hardware-based mobile security.

Findings

Achieved a 5% increase in precision over baseline methods.

Effectively identifies localized malware behaviors.

Maintained high recall despite addressing mislabeling issues.

Abstract

This study introduces RT-HMD, a Hardware-based Malware Detector (HMD) for mobile devices, that refines malware representation in segmented time-series through a Multiple Instance Learning (MIL) approach. We address the mislabeling issue in real-time HMDs, where benign segments in malware time-series incorrectly inherit malware labels, leading to increased false positives. Utilizing the proposed Malicious Discriminative Score within the MIL framework, RT-HMD effectively identifies localized malware behaviors, thereby improving the predictive accuracy. Empirical analysis, using a hardware telemetry dataset collected from a mobile platform across 723 benign and 1033 malware samples, shows a 5% precision boost while maintaining recall, outperforming baselines affected by mislabeled benign segments.