HPCMalHunter: Behavioral malware detection using hardware performance counters and singular value decomposition
Computer and Knowledge Engineering(2014)
摘要
Malicious programs, also known as malware, often use code obfuscation techniques to make static analysis more difficult and to evade signature-based detection. To resolve this problem, various behavioral detection techniques have been proposed that focus on the run-time behaviors of programs in order to dynamically detect malicious ones. Most of these techniques describe the run-time behavior of a program on the basis of its data flow and/or its system call traces. Recent work in behavioral malware detection has shown promise in using hardware performance counters (HPCs), which are a set of special-purpose registers built into modern processors providing detailed information about hardware and software events. In this paper, we pursue this line of research by presenting HPCMalHunter, a novel approach for real-time behavioral malware detection. HPCMalHunter uses HPCs to collect a set of event vectors from the beginning of a program's execution. It also uses the singular value decomposition (SVD) to reduce these event vectors and generate a behavioral vector for the program. By applying support vector machines (SVMs) to the feature vectors of different programs, it is able to identify malicious programs in real-time. Our results of experiments show that HPCMalHunter can detect malicious programs at the beginning of their execution with a high detection rate and a low false alarm rate.
更多查看译文
关键词
invasive software,program diagnostics,singular value decomposition,support vector machines,hpcmalhunter,svd,svm,behavioral detection techniques,behavioral malware detection,behavioral vector,code obfuscation techniques,false alarm rate,feature vectors,hardware performance counters,malicious programs,real-time behavioral malware detection,signature-based detection,static analysis,system call traces,hardware performance counter,hardware-level detection,real-time detection
AI 理解论文
溯源树
样例
生成溯源树,研究论文发展脉络
Chat Paper
正在生成论文摘要