RHMD: evasion-resilient hardware malware detectors

摘要: Hardware Malware Detectors (HMDs) have recently been proposed as a defense against the proliferation of malware. These detectors use low-level features, that can be collected by hardware performance monitoring units on modern CPUs to detect malware computational anomaly. Several aspects detector construction explored, leading with high accuracy. In this paper, we explore question how well evasive avoid detection HMDs. We show existing HMDs effectively reverse-engineered and subsequently evaded, allowing hide from without substantially slowing it down (which is important for certain types malware). This result demonstrates current generation easily defeated Next, evolve if exposed during training. simple detectors, such logistic regression, cannot even retraining. More sophisticated retrained malware, but evaded again. To address these limitations, propose new type Resilient (RHMDs) stochastically switch between different detectors. shown provably more difficult reverse engineer based resent results in probably approximately correct (PAC) learnability theory. indeed are resilient both engineering evasion, resilience increases number diversity individual Our demonstrate offer effective at low additional complexity.CCS CONCEPTSSecurity privacy $\rightarrow $ security implementation; its mitigation;