Power, Performance, and Area of HPC-Based Malware Detectors: An FPGA and Open-PDK ASIC Study

By Alireza Abolhasani Zeraatkar 1, Parnian Shabani Kamran 1, Parsa Mirfasihi 2, Saleh Khalaj Monfared 3, Hussain Al-Asaad 1
1 University of California, Davis, United States
2 San Francisco State University, San Francisco, United States
3 Worcester Polytechnic Institute, Worcester, United States

Abstract

Hardware malware detectors (HMDs) classify programs as benign or malicious based on hardware performance counter (HPC) data. Previous studies have shown that ensemble classifiers outperform other classifiers on detection metrics. However, the area, power, and timing costs of HMDs remain open questions. We address these questions across a comprehensive design space comprising multiple classifier families, variable HPC sets, and ensemble learning methods. We designed a pipeline to reconstruct selected trained models, generate synthesizable register-transfer-level (RTL) implementations, validate each design against a bit-accurate golden model, and evaluate the implementations. The results show that tree- and rule-based detectors achieve the highest detection performance with nearly an order of magnitude less area and several times lower energy than function-based classifiers. Reducing the number of HPC inputs to fit a processor's concurrent-counter limit preserves detection performance while substantially reducing area, power, and delay.

To read the full article, click here

×
Semiconductor IP