Academic Journal
Improving accuracy of HPC-based malware classification for embedded platforms using gradient descent optimization.
| Τίτλος: | Improving accuracy of HPC-based malware classification for embedded platforms using gradient descent optimization. |
|---|---|
| Συγγραφείς: | Alam, Manaar, Mukhopadhyay, Debdeep, Kadiyala, Sai Praveen, Lam, Siew-Kei, Srikanthan, Thambipillai |
| Πηγή: | Journal of Cryptographic Engineering; Nov2020, Vol. 10 Issue 4, p289-303, 15p |
| Περίληψη: | Malware detection is still one of the difficult problems in computer security because of the daily occurrences of newer varieties of malware programs. There have been enormous efforts in developing a generalized solution to this critical security aspect, but a little has been done considering the security of resource constraint embedded devices. In this paper, we attempt to develop a lightweight malware detection tool explicitly designed for embedded platforms using micro-architectural side-channel information obtained through Hardware Performance Counters (HPCs) and high-level programs representing Operating System (OS) resources. The methodology uses statistical hypothesis testing, in the form of t-test, to develop a metric, called λ , which indicates a conceptual boundary between the programs which are allowed to run on a given embedded platform, with the codes that are suspected as malwares. The metric is computed based on the observations obtained from carefully chosen features, which are tuples of high-level programs representing OS resources along with low-level HPCs. An ideal λ -value for a malicious program is 1, as opposed to 0 for a benign application. However, in reality, the efficacy of λ to classify a program as malware or benign largely depends on the proper assignment of weights to the tuples. We employ a gradient-descent-based learning mechanism to determine optimal choices for these weights. We present detailed experimental results on an embedded Linux running on an ARM processor which validates that the proposed lightweight side-channel-based learning mechanism improves the classification accuracy significantly compared to an ad-hoc selection of weights leading to significantly low false positives and false negatives in all our test cases. [ABSTRACT FROM AUTHOR] |
| Copyright of Journal of Cryptographic Engineering is the property of Springer Nature and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Βάση Δεδομένων: | Complementary Index |
| FullText | Text: Availability: 0 CustomLinks: – Url: https://dx.doi.org/doi:10.1007/s13389-020-00232-9 Name: EDS - Springer Nature Journals (s7799221) Category: fullText Text: View record at Springer – Url: https://resolver.ebsco.com/c/fiv2js/result?sid=EBSCO:edb&genre=article&issn=21908508&ISBN=&volume=10&issue=4&date=20201101&spage=289&pages=289-303&title=Journal of Cryptographic Engineering&atitle=Improving%20accuracy%20of%20HPC-based%20malware%20classification%20for%20embedded%20platforms%20using%20gradient%20descent%20optimization.&aulast=Alam%2C%20Manaar&id=DOI:10.1007/s13389-020-00232-9 Name: Full Text Finder (for New FTF UI) (ns324271) Category: fullText Text: Full Text Finder MouseOverText: Full Text Finder |
|---|---|
| Header | DbId: edb DbLabel: Complementary Index An: 146680436 RelevancyScore: 900 AccessLevel: 6 PubType: Academic Journal PubTypeId: academicJournal PreciseRelevancyScore: 899.6220703125 |
| IllustrationInfo | |
| Items | – Name: Title Label: Title Group: Ti Data: Improving accuracy of HPC-based malware classification for embedded platforms using gradient descent optimization. – Name: Author Label: Authors Group: Au Data: <searchLink fieldCode="AR" term="%22Alam%2C+Manaar%22">Alam, Manaar</searchLink><br /><searchLink fieldCode="AR" term="%22Mukhopadhyay%2C+Debdeep%22">Mukhopadhyay, Debdeep</searchLink><br /><searchLink fieldCode="AR" term="%22Kadiyala%2C+Sai+Praveen%22">Kadiyala, Sai Praveen</searchLink><br /><searchLink fieldCode="AR" term="%22Lam%2C+Siew-Kei%22">Lam, Siew-Kei</searchLink><br /><searchLink fieldCode="AR" term="%22Srikanthan%2C+Thambipillai%22">Srikanthan, Thambipillai</searchLink> – Name: TitleSource Label: Source Group: Src Data: Journal of Cryptographic Engineering; Nov2020, Vol. 10 Issue 4, p289-303, 15p – Name: Abstract Label: Abstract Group: Ab Data: Malware detection is still one of the difficult problems in computer security because of the daily occurrences of newer varieties of malware programs. There have been enormous efforts in developing a generalized solution to this critical security aspect, but a little has been done considering the security of resource constraint embedded devices. In this paper, we attempt to develop a lightweight malware detection tool explicitly designed for embedded platforms using micro-architectural side-channel information obtained through Hardware Performance Counters (HPCs) and high-level programs representing Operating System (OS) resources. The methodology uses statistical hypothesis testing, in the form of t-test, to develop a metric, called λ , which indicates a conceptual boundary between the programs which are allowed to run on a given embedded platform, with the codes that are suspected as malwares. The metric is computed based on the observations obtained from carefully chosen features, which are tuples of high-level programs representing OS resources along with low-level HPCs. An ideal λ -value for a malicious program is 1, as opposed to 0 for a benign application. However, in reality, the efficacy of λ to classify a program as malware or benign largely depends on the proper assignment of weights to the tuples. We employ a gradient-descent-based learning mechanism to determine optimal choices for these weights. We present detailed experimental results on an embedded Linux running on an ARM processor which validates that the proposed lightweight side-channel-based learning mechanism improves the classification accuracy significantly compared to an ad-hoc selection of weights leading to significantly low false positives and false negatives in all our test cases. [ABSTRACT FROM AUTHOR] – Name: Abstract Label: Group: Ab Data: <i>Copyright of Journal of Cryptographic Engineering is the property of Springer Nature and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract.</i> (Copyright applies to all Abstracts.) |
| PLink | https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=edb&AN=146680436 |
| RecordInfo | BibRecord: BibEntity: Identifiers: – Type: doi Value: 10.1007/s13389-020-00232-9 Languages: – Code: eng Text: English PhysicalDescription: Pagination: PageCount: 15 StartPage: 289 Titles: – TitleFull: Improving accuracy of HPC-based malware classification for embedded platforms using gradient descent optimization. Type: main BibRelationships: HasContributorRelationships: – PersonEntity: Name: NameFull: Alam, Manaar – PersonEntity: Name: NameFull: Mukhopadhyay, Debdeep – PersonEntity: Name: NameFull: Kadiyala, Sai Praveen – PersonEntity: Name: NameFull: Lam, Siew-Kei – PersonEntity: Name: NameFull: Srikanthan, Thambipillai IsPartOfRelationships: – BibEntity: Dates: – D: 01 M: 11 Text: Nov2020 Type: published Y: 2020 Identifiers: – Type: issn-print Value: 21908508 Numbering: – Type: volume Value: 10 – Type: issue Value: 4 Titles: – TitleFull: Journal of Cryptographic Engineering Type: main |
| ResultId | 1 |