Implications for Hardware Acceleration of Malware Detection

Due to the limited number of performance counters, the selection of architectural features is a critical issue to provide high quality data for malware detection. To address the issue, we come up with a metric called Degree of Distribution (DoD) as one of the malware detection criteria. Our experimental results show that the DoD can differentiate malware applications from benign applications and provide highly accurate detection through the machine learning framework. As architectural implications, hardware acceleration as well as additional PMC registers are discussed for more accurate malware detection in real-time.