HARDY: Hardware based Analysis for malwaRe Detection in embedded sYstems

Abstract

Increase in number of embedded systems which are interconnected has created need for mechanisms which can detect malicious exploits in a lightweight yet speed efficient fashion. Recent approaches that addressed this challenge focused on utilizing either high level or low level features along with machine learning algorithms to analyze behavior of unknown programs. However, the high level mechanisms are less tamper resistant and low level approaches result in high false positive. Moreover these approaches often consume high computational and storage resources, which are less suitable for embedded systems. In this paper, we present a custom hardware realization of a lightweight malware analysis approach. This approach analyzes an unknown program using a judicious combination of high level and low level features along some with statistical methods. We achieve an average of 3.06x reduction in power consumption and an average of 2.52x improvement in detection speed, when compared to existing hardware-based malware detection techniques and also a speed up of 1.8x compared to its software based realization.