Design Alternatives for Performance Monitoring Counter based Malware Detection

Abstract

Hardware-based malware detection is becoming increasingly important as software-based solutions can be easily compromised by attackers. Many of the existing hardware solutions are based on statistical learning blocks with processor behavioral information, which can be captured from the PMC (performance monitoring counters). The performance of the learning techniques relies primarily on the quality of data. However, due to the limited number of PMCs in a processor, only a few behavioral events can be monitored simultaneously. In this paper, we focus on multiple steps to investigate critical issues of PMC based malware detection: (i) statistical characterization of malware; (ii) distribution-based feature selection; (iii) trade-off analysis of complexity and accuracy; and (iv) design alternatives for PMC-based malware detection. Our experimental results show that the proposed detection scheme can provide highly accurate malware detection. As architectural implications, hardware acceleration as well as additional PMC registers are discussed for more accurate malware detection in real-time.