Malware Detection Using Power Consumption and Network Traffic Data

Even though malware detection is an active area of research, not many works have used features extracted from physical properties, such as power consumption. This paper is focused on malware detection using power consumption and network traffic data collected using our experimental testbed. Seven power-based and eighteen network traffic-based features were extracted and ten supervised machine learning algorithms were used for classification. The main findings include: (1) Among the best performing learners, Random Forest had the highest F-score and close to the highest G-score. (2) Power data extracted from the +12V CPU rails led to better performance than power data from the other three voltage rails. (3) Using only power-based features provided better performance than using only network traffic-based features; using both types of features had the best performance. (4) Feature selection based on information gain was used to identify the smallest numbers of features sufficient to successfully distinguish malware from non-malicious software. The top eleven features provided the same performance as using all 25 features. Five out of seven power-based features were among the top eleven features.