TWC: Small: Collaborative: Practical Hardware-Assisted Always-On Malware Detection

该项目探索在硬件中构建对恶意软件检测的支持。随着恶意软件的数量和复杂性的增加，恶意软件检测具有挑战性和资源密集性。恶意软件检测的资源要求限制了其在实践中的使用，使得许多系统上的恶意软件没有得到检查。我们使用低级硬件检测器来识别恶意软件，利用低级特征如硬件事件、指令混合和内存地址模式来识别计算异常。一旦怀疑是恶意软件，我们就通知更高级别的软件检测或保护机制，该机制可以将其资源仅集中在可疑的恶意软件上。该检测器使用低复杂度的机器学习方法，使用在硬件上可行的实现将恶意软件与正常程序分类。该项目探索基于对抗性机器学习的对策，以限制攻击者试图逃避检测，开发硬件和软件检测之间的安全集成，并评估实施权衡。该项目提供了一种新的方法来提高恶意软件检测的有效性，并允许系统在不需要软件监视器所需的大量资源投资的情况下得到持续保护。该项目有望对一个国家迫切需要的领域产生重大影响，以帮助保护系统免受不断扩大的恶意软件威胁。提案中遵循的原则可以推广到不同的计算环境，包括移动电话、云和网络物理系统。

The project explores building support for malware detection in hardware. Malware detection is challenging and resource intensive, as the number and sophistication of malware increases. The resource requirements for malware detection limit its use in practice, leaving malware unchecked on many systems. We use a low level hardware detector to identify malware as a computational anomaly using low level features such as hardware events, instruction mixes and memory address patterns. Once malware is suspected, we inform a higher level software detection or protection mechanism that can focus its resources only on suspected malware. The detector uses low complexity machine learning approaches to classify malware from normal programs using implementations that are feasible in hardware. The project explores countermeasures based on adversarial machine learning to limit attackers trying to evade detection, develops secure integration between the hardware and software detection, and evaluates implementation tradeoffs. The project contributes a new approach to improve the effectiveness of malware detection and to allow systems to be protected continuously without requiring the large resource investment needed by software monitors. The project holds the promise of significantly impacting an area of critical national need to help secure systems against the expanding threats of malware. The principles pursued in the proposal can generalize to different computational environments including mobile phones, clouds, and cyberphysical systems.