Hardware performance counters based runtime anomaly detection using SVM
Hardware performance counters based runtime anomaly detection using SVM
复制标题
使用 SVM 基于硬件性能计数器的运行时异常检测
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Y. Aung
中科院分区：
文献类型：
--
作者：
Muhamed Fauzi Bin Abbas;S. Kadiyala;A. Prakash;T. Srikanthan;Y. Aung
不断发展的异常的本质在攻击防御计划时变得更加复杂和复杂，从而导致了严重的妥协。现有的基于软件的技术旨在使用另一个软件来保护脆弱的软件，该软件也容易妥协，例如基于混淆的攻击。另一方面，硬件性能计数器提供了一种强大的检测机制，难以妥协，因为与硬件功能相比，篡改软件组件要容易。因此，在本文中，我们提出了一种基于硬件的监视方法，用于使用精心选择的低级硬件功能检测异常时，以嵌入式设备。接下来，使用支持向量机（SVM）分类器来训练一个模型，该模型可以根据从所选硬件性能计数器获得的功能来检测异常。实验结果表明，所提出的方法可以在仅依靠一个训练有素的模型的同时，达到接近100％异常检测率的准确性。可以在各种平台上推广此方法。
The nature of ever evolving anomalies have become more sophisticated and complex in attacking the defense schemes, thereby leading to serious compromises. Existing software based techniques aim to protect a vulnerable software with another software which is also prone to compromise like obfuscation-based attacks. On the other hand, hardware performance counters offer a robust detection mechanism that is difficult to compromise since it is easier to tamper the software components than hardware features. Hence, in this paper, we propose a hardware-based monitoring method for embedded devices in detecting anomalies using carefully selected low-level hardware features. Next, a support vector machine (SVM) classifier is used to train a model that can detect anomalies based on features obtained from the selected hardware performance counters. Experimental results show that the proposed approach can achieve an accuracy of close to 100% anomaly detection rate while relying only on a single trained model. This approach can be generalized across various platforms.