EAGER: Run-Time Hardware-Assisted Malware Detection Using Machine Learning

恶意软件是任何类型恶意软件的广义术语，是网络攻击者设计的一段代码，用于在未经用户同意的情况下感染计算系统，通常用于窃取敏感信息等有害目的。无处不在的信息技术使恶意软件成为一个严重的威胁。检测系统中的恶意软件是一项艰巨的任务，特别是当恶意软件是隐形的时。硬件辅助的恶意软件检测（HMD）机制寻求恶意软件的运行时检测。然而，HMD的部署存在若干挑战，包括硬件寄存器的有限可用性、微架构事件的多样性以及针对隐形恶意软件的异常行为检测的困难。提出的研究旨在寻找轻量级的HMD，是不是太昂贵的实施和提供持续的运行时monitoring.The核心研究议程是轻量级恶意软件检测机制的发展，使用低层次的微体系结构行为。具体来说，这个项目是感兴趣的（i）开发有效的机器学习分类器对恶意软件是相对便宜的实施;和（ii）开发工具和方法，用于评估各种解决方案的有效性和鲁棒性。从社会的角度来看，这项工作通过涉及研究生，本科生，少数民族和女学生，并丰富了在UCD提供的几门课程。拟议的研究工作可以激发和实现保护计算机系统的新方法，特别是在计算需求受到限制的物联网（IoT）等新兴领域。研究结果将被整合到研究者提供的研究生和本科生课程中，提出的解决方案将通过公共门户网站、www.example.com和GitHub自由分享和广泛传播：https://github.com/ASEEC/ML_classifier和https://github.com/ASEEC/HPC_Trace.This奖项反映了NSF的法定使命，并被认为值得通过使用基金会的智力价值和更广泛的影响审查标准进行评估来支持。https://ece.gmu.edu/~hhomayou/publications.html

Malware, a broad term for any type of malicious software, is a piece of code designed by cyber attackers to infect computing systems without the user consent, typically for harmful purposes such as stealing sensitive information. The ubiquity of information technology has made malware a serious threat. Detecting malware in a system is a difficult task, particularly when the malware is stealthy. Hardware-assisted malware detection (HMD) mechanisms seek runtime detection of malware. However, several challenges exist with deployment of HMD including limited availability of hardware registers, diversity of microarchitectural events, and difficulty of anomalous behavior detection for stealthy malware. Proposed research aims to find lightweight HMDs that are not too costly to implement and provide continuous runtime monitoring.The core research agenda is development of lightweight malware detection mechanisms using low level microarchitectural behavior. Specifically, this project is interested in (i) developing effective machine-learning classifier against malware that are relatively inexpensive to implement; and (ii) development of tools and methods for evaluating effectiveness and robustness of various solution alternatives.From a societal viewpoint, this work enhances the research, education, and diversity at University of California Davis (UCD) by involving graduate, undergraduate, minority and female students, and enriches several courses that are offered at UCD. The proposed research effort could inspire and enable new approaches to securing computer systems, in particular in emerging domains such as Internet-of-Things (IoT), where computational requirement is constrained. Research results will be integrated in graduate and undergraduate courses offered by the investigator.The proposed solutions will be freely shared and broadly disseminated through public portals, https://ece.gmu.edu/~hhomayou/publications.html and GitHub: https://github.com/ASEEC/ML_classifier and https://github.com/ASEEC/HPC_Trace.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.