HPC-Based Malware Detectors Actually Work: Transition to Practice After a Decade of Research

Charalambos Konstantinou; Xueyang Wang; Prashanth Krishnamurthy; Farshad Khorrami; Michail Maniatakos; Ramesh Karri

doi:10.1109/MDAT.2022.3143438

HPC-Based Malware Detectors Actually Work: Transition to Practice After a Decade of Research

Charalambos Konstantinou, Xueyang Wang, Prashanth Krishnamurthy, Farshad Khorrami, Michail Maniatakos, Ramesh Karri

Research output: Contribution to journal › Article › peer-review

Abstract

For the first time in 2011, researchers proposed using Hardware Performance Counters (HPCs) that are built into all processors as a pragmatic yet zero-cost solution for security. Online monitoring of HPCs can defend against malware using anomaly detection. Over the last decade, HPC-based malware detection transitioned from academic research through government transition to industry adoption. We outline this evolution by presenting use cases on critical power grid infrastructure protection as part of DARPA RADICS program, as well as describing how HPCs are utilized within Intel’s HPC-based Threat Detection Technology (TDT), which is further used by Microsoft Defender for Endpoint.

Original language	English (US)
Pages (from-to)	23-32
Number of pages	10
Journal	IEEE Design and Test
Volume	39
Issue number	4
DOIs	https://doi.org/10.1109/MDAT.2022.3143438
State	Published - Aug 1 2022

Keywords

Cybersecurity
Embedded systems
Hardware performance counters
Malware detection
Transition to practice

ASJC Scopus subject areas

Software
Hardware and Architecture
Electrical and Electronic Engineering

Access to Document

10.1109/MDAT.2022.3143438

Cite this

@article{d69681ba8f204ad8ba11f2e3809cfa1d,

title = "HPC-Based Malware Detectors Actually Work: Transition to Practice After a Decade of Research",

abstract = "For the first time in 2011, researchers proposed using Hardware Performance Counters (HPCs) that are built into all processors as a pragmatic yet zero-cost solution for security. Online monitoring of HPCs can defend against malware using anomaly detection. Over the last decade, HPC-based malware detection transitioned from academic research through government transition to industry adoption. We outline this evolution by presenting use cases on critical power grid infrastructure protection as part of DARPA RADICS program, as well as describing how HPCs are utilized within Intel{\textquoteright}s HPC-based Threat Detection Technology (TDT), which is further used by Microsoft Defender for Endpoint.",

keywords = "Cybersecurity, Embedded systems, Hardware performance counters, Malware detection, Transition to practice",

author = "Charalambos Konstantinou and Xueyang Wang and Prashanth Krishnamurthy and Farshad Khorrami and Michail Maniatakos and Ramesh Karri",

year = "2022",

month = aug,

day = "1",

doi = "10.1109/MDAT.2022.3143438",

language = "English (US)",

volume = "39",

pages = "23--32",

journal = "IEEE Design and Test",

issn = "2168-2356",

publisher = "IEEE Computer Society",

number = "4",

}

TY - JOUR

T1 - HPC-Based Malware Detectors Actually Work

T2 - Transition to Practice After a Decade of Research

AU - Konstantinou, Charalambos

AU - Wang, Xueyang

AU - Krishnamurthy, Prashanth

AU - Khorrami, Farshad

AU - Maniatakos, Michail

AU - Karri, Ramesh

PY - 2022/8/1

Y1 - 2022/8/1

N2 - For the first time in 2011, researchers proposed using Hardware Performance Counters (HPCs) that are built into all processors as a pragmatic yet zero-cost solution for security. Online monitoring of HPCs can defend against malware using anomaly detection. Over the last decade, HPC-based malware detection transitioned from academic research through government transition to industry adoption. We outline this evolution by presenting use cases on critical power grid infrastructure protection as part of DARPA RADICS program, as well as describing how HPCs are utilized within Intel’s HPC-based Threat Detection Technology (TDT), which is further used by Microsoft Defender for Endpoint.

AB - For the first time in 2011, researchers proposed using Hardware Performance Counters (HPCs) that are built into all processors as a pragmatic yet zero-cost solution for security. Online monitoring of HPCs can defend against malware using anomaly detection. Over the last decade, HPC-based malware detection transitioned from academic research through government transition to industry adoption. We outline this evolution by presenting use cases on critical power grid infrastructure protection as part of DARPA RADICS program, as well as describing how HPCs are utilized within Intel’s HPC-based Threat Detection Technology (TDT), which is further used by Microsoft Defender for Endpoint.

KW - Cybersecurity

KW - Embedded systems

KW - Hardware performance counters

KW - Malware detection

KW - Transition to practice

UR - http://www.scopus.com/inward/record.url?scp=85123341750&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85123341750&partnerID=8YFLogxK

U2 - 10.1109/MDAT.2022.3143438

DO - 10.1109/MDAT.2022.3143438

M3 - Article

AN - SCOPUS:85123341750

SN - 2168-2356

VL - 39

SP - 23

EP - 32

JO - IEEE Design and Test

JF - IEEE Design and Test

IS - 4

ER -

HPC-Based Malware Detectors Actually Work: Transition to Practice After a Decade of Research

Abstract

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this