• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>IEEE transactions on dependable and secure computing >EnsembleHMD: Accurate Hardware Malware Detectors with Specialized Ensemble Classifiers
【24h】

EnsembleHMD: Accurate Hardware Malware Detectors with Specialized Ensemble Classifiers

机译：Ensemblehmd：精确的硬件恶意软件探测器，具有专门的集合分类器

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Hardware-based malware detectors (HMDs) are a promising new approach to defend against malware. HMDs collect low-level architectural features and use them to classify malware from normal programs. With simple hardware support, HMDs can be always on, operating as a first line of defense that prioritizes the application of more expensive and more accurate software-detector. In this paper, our goal is to increase the accuracy of HMDs, to improve detection, and reduce overhead. We use specialized detectors targeted towards a specific type of malware to improve the detection of each type. Next, we use ensemble learning techniques to improve the overall accuracy by combining detectors. We explore detectors based on logistic regression (LR) and neural networks (NN). The proposed detectors reduce the false-positive rate by more than half compared to using a single detector, while increasing their sensitivity. We develop metrics to estimate detection overhead; the proposed detectors achieve more than 16.6x overhead reduction during online detection compared to an idealized software-only detector, with an 8x improvement in relative detection time. NN detectors outperform LR detectors in accuracy, overhead (by 40 percent), and time-to-detection of the hardware component (by 5x). Finally, we characterize the hardware complexity by extending an open-core and synthesizing it on an FPGA platform, showing that the overhead is minimal.
机译：基于硬件的恶意软件探测器（HMDS）是一种抵御恶意软件的有希望的新方法。 HMDS收集低级架构功能，并使用它们来对来自普通程序的恶意软件进行分类。通过简单的硬件支持，HMD可以始终打开，作为优先考虑应用更昂贵和更准确的软件检测器的第一行防线。在本文中，我们的目标是提高HMDS的准确性，改善检测，减少开销。我们使用针对特定类型恶意软件的专用探测器来改善每种类型的检测。接下来，我们使用集合学习技术来通过组合探测器来提高整体精度。我们探索基于逻辑回归（LR）和神经网络（NN）的探测器。与使用单个探测器相比，所提出的探测器将假阳性率降低超过一半，同时提高了它们的灵敏度。我们开发指标来估计检测开销;与理想化的软件检测器相比，所提出的探测器在线检测期间实现了超过16.6倍的开销减少，相比具有相对检测时间的8倍提高了8倍。 NN探测器以准确性，开销（乘40％）和硬件组件（5倍）的时间检测，探测器探测器。最后，我们通过在FPGA平台上扩展开放核心并在FPGA平台上延伸并将其合成来表征硬件复杂性，显示开销是最小的。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号