Hardware performance counters based runtime anomaly detection using SVM

The nature of ever evolving anomalies have become more sophisticated and complex in attacking the defense schemes, thereby leading to serious compromises. Existing software based techniques aim to protect a vulnerable software with another software which is also prone to compromise like obfuscation-based attacks. On the other hand, hardware performance counters offer a robust detection mechanism that is difficult to compromise since it is easier to tamper the software components than hardware features. Hence, in this paper, we propose a hardware-based monitoring method for embedded devices in detecting anomalies using carefully selected low-level hardware features. Next, a support vector machine (SVM) classifier is used to train a model that can detect anomalies based on features obtained from the selected hardware performance counters. Experimental results show that the proposed approach can achieve an accuracy of close to 100% anomaly detection rate while relying only on a single trained model. This approach can be generalized across various platforms.