Time Series-Based Malware Detection Using Hardware Performance Counters

With the advent of Internet-of-Things (IoT), Malware has been exponentially proliferating across a plethora of platforms including PC, mobile, and other embedded devices. Software-based solutions, such as Anti-Virus Software (AVS), are ineffective against modern Malware and incur an abundance of computational overhead. This has motivated researchers to develop Hardware-assisted Malware Detection techniques utilizing Hardware Performance Counters (HPCs). However, traditional HPC-based Malware detection does not account for the temporal order of the data. Consequently, false positives, i.e., benign application being classified as Malware, become a major predicament. Furthermore, some devices are extremely limited in their hardware profiling capabilities, resulting in a limited feature space. To address these issues, we propose employing HPC data in conjunction with time series-based classifiers. Additionally, we introduce a Sequential Time Series-based Detection (SEQ-TSD) framework for identifying Malware. The proposed methodology uses only a single HPC, thereby reducing the profiling overhead. Our experimental results prove that the proposed framework can bolster the performance using only a single HPC to detect Malware with up to 95% accuracy, while incurring only a 5.56% false positive rate. Furthermore, we demonstrate that combining multiple HPCs in conjunction with SEQ-TSD boosts the average detection accuracy up to 97.91%.