Quantifying and improving the efficiency of hardware-based mobile malware detectors

摘要: Hardware-based malware detectors (HMDs) are a key emerging technology to build trustworthy systems, especially mobile platforms. Quantifying the efficacy of HMDs against malicious adversaries is thus an important problem. The challenge lies in that real-world adapts defenses, evades being run experimental settings, and hides behind benign applications. Thus, realizing potential as small battery-efficient line defense requires rigorous foundation for evaluating HMDs. We introduce Sherlock — white-box methodology quantifies HMD's ability detect identify reason why. first deconstructs into atomic, orthogonal actions synthesize diverse suite. then drives both programs with real user-inputs, compares their executions determine operating range, i.e., smallest HMD can detect. show three case studies using not only quantify HMDs' ranges but design better detectors. First, information about concrete actions, we discrete-wavelet transform based unsupervised outperforms prior work on power transforms by 24.7% (AUC metric). Second, training supervised Sherlock's dataset yields 12.5% than past approaches train ad-hoc subsets malware. Finally, shows why instance detectable. This surprising new result obfuscation techniques used evade static analyses makes them more detectable