Hardware malware detectors balance power performance and chip area costs
Power, Performance, and Area of HPC-Based Malware Detectors: An FPGA and Open-PDK ASIC Study
Cryptography and SecurityHardware Architecture
Summary
Malware detectors that use hardware performance counters (HPCs) help recognize harmful software based on computer hardware signals. The authors explored how different types of detectors perform and their costs in power, chip size, and speed. They found that tree- and rule-based detectors work well while using much less energy and chip space compared to function-based ones. Also, using fewer HPCs (hardware counters) keeps the detection quality high but reduces cost and delay. This study helps design more efficient hardware for catching malware.
What this means in practice
- •For hardware designers: Build efficient malware detection circuits by choosing low-power, small-area classifiers that keep strong detection ability.
- •For embedded systems engineers: Design embedded processors that use fewer hardware counters without degrading malware detection performance to save energy and chip area.
Authors
Alireza Abolhasani Zeraatkar, Parnian Shabani Kamran, Parsa Mirfasihi, Saleh Khalaj Monfared, Hussain Al-Asaad
Abstract
Hardware malware detectors (HMDs) classify programs as benign or malicious based on hardware performance counter (HPC) data. Previous studies have shown that ensemble classifiers outperform other classifiers on detection metrics. However, the area, power, and timing costs of HMDs remain open questions. We address these questions across a comprehensive design space comprising multiple classifier families, variable HPC sets, and ensemble learning methods. We designed a pipeline to reconstruct selected trained models, generate synthesizable register-transfer-level (RTL) implementations, validate each design against a bit-accurate golden model, and evaluate the implementations. The results show that tree- and rule-based detectors achieve the highest detection performance with nearly an order of magnitude less area and several times lower energy than function-based classifiers. Reducing the number of HPC inputs to fit a processor's concurrent-counter limit preserves detection performance while substantially reducing area, power, and delay.