Hardware Micro-architectural Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus software is ineffective against evolving malware variants, such as polymorphic and metamorphic viruses, which can mutate and evade detection, and is vulnerable to being disabled or subverted, posing a significant threat in environments with proliferating malicious processes.
Innovation Solution
A method utilizing hardware-based micro-architectural data, including performance counter data, is employed to identify malicious processes by correlating temporal behavior patterns with machine-learning procedures, enabling detection of malware and side-channel attacks through analysis of processor load density, branch prediction, and instruction cache misses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based micro-architectural data is used for detection, then detection effectiveness against evolving malware is improved, but device complexity increases
Solution Approach 1:
The patent introduces hardware-based micro-architectural performance counters as an intermediary layer between the malware and the detection system. These counters capture behavioral data at the processor level without requiring direct access to malware code or signatures, thereby improving detection effectiveness while maintaining a manageable system architecture through specialized hardware components.
Solution Approach 2:
The patent replaces traditional software-based detection mechanisms (anti-virus software, signature matching) with hardware-based detection using micro-architectural performance counters. This substitution moves the detection capability from the software layer to the hardware layer, enabling more reliable detection of evolving malware variants while reducing the complexity of software-based analysis systems.
2Measurement precision
If machine-learning procedures are applied to micro-architectural data, then detection accuracy improves, but processing time increases
Solution Approach 1:
The patent applies machine-learning procedures offline to train classification models on micro-architectural data from malware and benign processes. This preliminary training phase creates pre-configured detection models that can then be deployed for real-time detection with minimal processing delay, thereby achieving high detection accuracy without excessive runtime processing time.
Solution Approach 2:
The patent uses micro-architectural performance counters to capture a focused set of behavioral features (instruction cache misses, branch prediction accuracy, processor load density) that are most indicative of malware behavior. By concentrating on these specific partial features rather than analyzing complete process data, the system achieves high detection accuracy with reduced processing time.
3Reliability
If detection operates beneath system software, then security against subversion is improved, but access to process information becomes more difficult
Solution Approach 1:
The patent extracts detection capabilities from the software layer and embeds them directly in the hardware layer through micro-architectural performance counters. This extraction allows the system to operate beneath system software with improved security against subversion, while the counters themselves provide direct access to process behavioral information through hardware-based measurement mechanisms.
Solution Approach 2:
The hardware-based performance counters automatically capture micro-architectural data without requiring software intervention or access permissions. The detection system queries these counters to obtain process behavioral information, enabling secure operation beneath system software while maintaining ease of data access through self-service hardware mechanisms.
Data Source
AI summary
Disclosed are devices, systems, apparatus, methods, products, media and other implementations, including a method that includes obtaining hardware-based micro-architectural data, including hardware-based micro-architectural counter data, for a hardware device executing one or more processes, and determining based, at least in part, on the hardware-based micro-architectural data whether at least one of the one or more processes executing on the hardware device corresponds to a malicious process. In some embodiments, determining based on the hardware-based micro-architectural data whether the at least one of the one or more processes corresponds to a malicious process may include applying one or more machine-learning procedures to the hardware-based micro-architectural data to determine whether the at least one of the one or more processes corresponds to the malicious process.