Ensemble Learning for Low-Level Hardware-Supported Malware Detection

Recent work demonstrated hardware-based online malware detection using only low-level features. This detector is envisioned as a first line of defense that prioritizes the application of more expensive and more accurate software detectors. Critical to such a framework is the detection performance of the hardware detector. In this paper, we explore the use of both specialized detectors and ensemble learning techniques to improve performance of the hardware detector. The proposed detectors reduce the false positive rate by more than half compared to a single detector, while increasing the detection rate. We also contribute approximate metrics to quantify the detection overhead, and show that the proposed detectors achieve more than 11x reduction in overhead

• Type: Journal
• Year: 2015
• Where: RAID
• Authors: Khaled N. Khasawneh, Meltem Ozsoy, Caleb Donovick, Nael B. Abu-Ghazaleh, Dmitry V. Ponomarev
• Keywords: Computer Networks, RAID 2015