Analyzing the Efficiency of Machine Learning Classifiers in Hardware-Based Malware Detectors
Analyzing the Efficiency of Machine Learning Classifiers in Hardware-Based Malware Detectors
复制标题
分析基于硬件的恶意软件检测器中机器学习分类器的效率
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
K. Basu
中科院分区：
文献类型：
--
作者：
Abraham Peedikayil Kuruvila;Shamik Kundu;K. Basu
前景看好的物联网(IoT)支持的消费电子设备的出现，导致它们在几个安全关键型架构中全面扩散。随着恶意软件在现代消费电子产品中不断演变和升级，识别此类恶意实体非常必要，以避免意外的系统行为。现代形态恶意软件可以伪装成良性程序，从而躲避传统反病毒软件的检测。因此，使用硬件性能计数器(HPC)的恶意软件检测器在该领域获得了吸引力。HPC是特殊用途寄存器的集合集成，用于跟踪低级微体系结构事件，如分支采取、缓存命中等。机器学习分类器针对显示的HPC数据进行训练，然后部署在基于硬件的恶意软件检测器(HMD)上，从而有效地检测隐蔽的恶意软件活动。本文探讨了这类传统机器学习算法在执行时获得的HPC值上的性能，以评估将应用程序分类为恶意软件或良性软件的效率。对每种机器学习算法的多变量网络参数的全面实验分析表明，随机森林分类器提供了83.04%的类领先检测精度。
The emergence of promising Internet-of-things (IoT) empowered Consumer Electronic devices resulted in their exhaustive proliferation across several safety-critical architectures. As Malware continue to evolve and escalate in form factor and count in modern-day consumer electronics, identifying such malicious entities is highly imperative to avoid unanticipated system behaviour. Modern morphic Malware can hide itself under the garb of a benign program, thus, evading detection by a conventional anti-virus software. Hence, Malware detectors using Hardware Performance Counters (HPCs) are gaining traction in this domain. HPCs are a collective integration of special purpose registers utilised to track low-level micro-architectural events such as branches taken, cache hits, etc. Machine Learning classifiers are trained on the manifested HPC data and then deployed on Hardware-based Malware Detectors (HMDs), which efficiently detect the incognito Malware activity. This paper explores the performance of such traditional Machine Learning algorithms over the HPC values obtained at execution, to estimate the efficiency of classifying an application as Malware or benign. A thorough experimental analysis of the multivariate network parameters for each Machine Learning algorithm projects the Random Forest classifier to furnish a class-leading detection accuracy of 83.04%.