HLMD: a signature-based approach to hardware-level behavioral malware detection and classification

  • Mohammad Bagher Bahador
  • Mahdi AbadiEmail author
  • Asghar Tajoddin


Malicious programs, or malware, often use code obfuscation techniques to make static analysis difficult. To deal with this problem, various behavioral detection techniques have been proposed that focus on runtime behavior to distinguish between benign and malicious programs. The majority of them are based on the analysis and modeling of system call traces, which are a common type of audit data often used to describe the interaction between programs and the operating system. However, the techniques are not widely used in practice because of high performance overheads. An alternative approach is to perform behavioral detection at the hardware level. The basic idea is to use information that is accessible through hardware performance counters, which are a set of special purpose registers built into modern processors providing detailed information about hardware and software events. In this paper, we pursue this line of research by presenting HLMD, a novel approach that uses behavioral signatures generated from hardware performance counter traces to instantly detect and disable malicious programs at the beginning of their execution. HLMD is especially suitable for independent malicious programs that can be run standalone without having to be attached to a host program. Each behavioral signature is composed of some number of singular values and singular vectors, obtained by applying the singular value decomposition to the hardware performance counter traces of a known malware family. HLMD follows a two-stage heuristic matching strategy to increase the detection performance to an acceptable level while reducing the detection complexity to linear time. The results of our experiments performed on a dataset of benign and malicious programs show that HLMD can achieve an average precision, recall, and F-measure of 95.19%, 89.96%, and 92.50%, respectively.


Malware detection and classification Behavioral signature Hardware performance counter Singular value decomposition 



  1. 1.
    Abualigah LM, Khader AT, Hanandeh ES (2018) Hybrid clustering analysis using improved krill herd algorithm. Appl Intell 48(11):4047–4071. CrossRefGoogle Scholar
  2. 2.
    Akhgar B, Saathoff GB, Arabnia HR, Hill R, Staniforth A, Bayerl PS (2015) Application of big data for national security: a practitioner’s guide to emerging technologies. Butterworth-Heinemann, NewtonGoogle Scholar
  3. 3.
    Amamra A, Robert JM, Abraham A, Talhi C (2016) Generative versus discriminative classifiers for Android anomaly-based detection system using system calls filtering and abstraction process. Secur Commun Netw 9(16):3483–3495. CrossRefGoogle Scholar
  4. 4.
    Bahador MB, Abadi M, Tajoddin A (2014) HPCMalHunter: behavioral malware detection using hardware performance counters and singular value decomposition. In: Proceedings of the 2014 4th International Conference on Computer and Knowledge Engineering (ICCKE), pp 703–708. IEEE, Piscataway.
  5. 5.
    Bayer U, Milani Comparetti P, Hlauschek C, Kruegel C, Kirda E (2009) Scalable, behavior-based malware clustering. In: Proceedings of the 2009 Network and Distributed System Security Symposium (NDSS), pp 1–18. The Internet SocietyGoogle Scholar
  6. 6.
    Bellard F (2005) QEMU, a fast and portable dynamic translator. In: Proceedings of the 2005 USENIX Annual Technical Conference, pp 41–46. USENIX Association, BerkeleyGoogle Scholar
  7. 7.
    Browne S, Dongarra J, Garner N, Ho G, Mucci P (2000) A portable programming interface for performance evaluation on modern processors. Int J High Perform Comput Appl 14(3):189–204. CrossRefGoogle Scholar
  8. 8.
    Canzanese R, Mancoridis S, Kam M (2015) System call-based detection of malicious processes. In: Proceedings of the 2015 IEEE International Conference on Software Quality, Reliability and Security (QRS), pp 119–124. IEEE, Piscataway.
  9. 9.
    Christodorescu M, Jha S (2003) Static analysis of executables to detect malicious patterns. In: Proceedings of the 12th USENIX Security Symposium, pp 169–186. USENIX Association, BerkeleyGoogle Scholar
  10. 10.
    Christodorescu M, Jha S, Kruegel C (2007) Mining specifications of malicious behavior. In: Proceedings of the 6th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC-FSE), pp 5–14. ACM, New York.
  11. 11.
    Das S, Chen B, Chandramohan M, Liu Y, Zhang W (2018) ROPSentry: runtime defense against ROP attacks using hardware performance counters. Comput Secur 73:374–388. CrossRefGoogle Scholar
  12. 12.
    Das S, Werner J, Antonakakis M, Polychronakis M, Monrose F (2019) The challenges, pitfalls, and perils of using hardware performance counters for security. In: Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), pp 345–363. IEEE Computer Society, Washington.
  13. 13.
    Deligiannidis L, Arabnia HR (2015) Security surveillance applications utilizing parallel video-processing techniques in the spatial domain. In: Emerging Trends in Image Processing, Computer Vision and Pattern Recognition, pp 117–130. Morgan Kaufmann, Boston.
  14. 14.
    Demme J, Maycock M, Schmitz J, Tang A, Waksman A, Sethumadhavan S, Stolfo SJ (2013) On the feasibility of online malware detection with performance counters. ACM SIGARCH Comput Archit News 41(3):559–570. CrossRefGoogle Scholar
  15. 15.
    Demme J, Sethumadhavan S (2011) Rapid identification of architectural bottlenecks via precise event counting. ACM SIGARCH Comput Archit News 39(3):353–364. CrossRefGoogle Scholar
  16. 16.
    Garcia-Serrano A (2015) Anomaly detection for malware identification using hardware performance counters. CoRR arXiv:abs/1508.07482
  17. 17.
    Golub GH, Van Loan CF (2013) Matrix computations, 4th edn. Johns Hopkins University Press, BaltimorezbMATHGoogle Scholar
  18. 18.
    Gupta S, Kumar P (2015) An immediate system call sequence based approach for detecting malicious program executions in cloud environment. Wireless Pers Commun 81(1):405–425. CrossRefGoogle Scholar
  19. 19.
    Ibrahim A, Valle M, Noli L, Chible H (2015) Assessment of FPGA implementations of one sided Jacobi algorithm for singular value decomposition. In: Proceedings of the 2015 IEEE Computer Society Annual Symposium on VLSI (ISVLSI), pp 56–61. IEEE Computer Society, Washington.
  20. 20.
    Intel Corporation: Intel 64 and IA-32 architectures software developer’s manuals (2019).
  21. 21.
    Jacob G, Debar H, Filiol E (2008) Behavioral detection of malware: from a survey towards an established taxonomy. J Comput Virol 4(3):251–266. CrossRefGoogle Scholar
  22. 22.
    Kazdagli M, Reddi VJ, Tiwari M (2016) Quantifying and improving the efficiency of hardware-based mobile malware detectors. In: Proceedings of the 2016 49th Annual IEEE/ACM International Symposium on Microarchitecture (MICRO), pp 1–13. IEEE, Piscataway.
  23. 23.
    Lanzi A, Balzarotti D, Kruegel C, Christodorescu M, Kirda E (2010) AccessMiner: using system-centric models for malware protection. In: Proceedings of the 17th ACM Conference on Computer and Communications Security (CCS), pp 399–412. ACM, New York.
  24. 24.
    Möbius C, Dargie W, Schill A (2014) Power consumption estimation models for processors, virtual machines, and servers. IEEE Trans Parallel Distrib Syst 25(6):1600–1614. CrossRefGoogle Scholar
  25. 25.
    Moser A, Kruegel C, Kirda E (2007) Limits of static analysis for malware detection. In: Proceedings of the 23rd Annual Computer Security Applications Conference (ACSAC), pp 421–430. IEEE, Piscataway.
  26. 26.
    Ozsoy M, Donovick C, Gorelik I, Abu-Ghazaleh N, Ponomarev D (2015) Malware-aware processors: a framework for efficient online malware detection. In: Proceedings of the 2015 IEEE 21st International Symposium on High Performance Computer Architecture (HPCA), pp 651–661. IEEE Computer Society, Washington.
  27. 27.
    Pappas V, Polychronakis M, Keromytis AD (2013) Transparent ROP exploit mitigation using indirect branch tracing. In: Proceedings of the 22nd USENIX Security Symposium, pp 447–462. USENIX Association, BerkeleyGoogle Scholar
  28. 28.
    Pfaff D, Hack S, Hammer C (2015) Learning how to prevent return-oriented programming efficiently. In: Piessens F, Caballero J, Bielova N (eds) Engineering secure software and systems, lecture notes in computer science, vol 8978. Springer, Cham, pp 68–85. Google Scholar
  29. 29.
    Sayadi H, Patel N, DinakarRao SMP, Sasan A, Rafatirad S, Homayoun H (2018) Ensemble learning for effective run-time hardware-based malware detection: a comprehensive analysis and classification. In: Proceedings of the 55th Annual Design Automation Conference (DAC), pp 1–6. ACM, New York.
  30. 30.
    Singh B, Evtyushkin D, Elwell J, Riley R, Cervesato I (2017) On the detection of kernel-level rootkits using hardware performance counters. In: Proceedings of the 2017 ACM Asia Conference on Computer and Communications Security (ASIA CCS), pp 483–493. ACM, New York.
  31. 31.
    Sokolova M, Lapalme G (2009) A systematic analysis of performance measures for classification tasks. Inf Process Manag 45(4):427–437. CrossRefGoogle Scholar
  32. 32.
    Tang A, Sethumadhavan S, Stolfo SJ (2014) Unsupervised anomaly-based malware detection using hardware features. In: Stavrou A, Bos H, Portokalidis G (eds) Research in attacks, intrusions and defenses, lecture notes in computer science, vol 8688. Springer, Cham, pp 109–129. Google Scholar
  33. 33.
    Uhsadel L, Georges A, Verbauwhede I (2008) Exploiting hardware performance counters. In: Proceedings of the 2008 5th Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC), pp 59–67. IEEE, Piscataway.
  34. 34.
    Vogl S, Eckert C (2012) Using hardware performance events for instruction-level monitoring on the x86 architecture. In: Proceedings of the 2012 European Workshop on System Security (EuroSec), pp 1–6Google Scholar
  35. 35.
    Wang X, Karri R (2016) Reusing hardware performance counters to detect and identify kernel control-flow modifying rootkits. IEEE Trans Comput Aided Des Integr Circuits Syst 35(3):485–498. CrossRefGoogle Scholar
  36. 36.
    Wang X, Zambreno J (2014) An FPGA implementation of the Hestenes-Jacobi algorithm for singular value decomposition. In: Proceedings of the 2014 IEEE International Parallel & Distributed Processing Symposium Workshops (IPDPSW), pp 220–227. IEEE Computer Society, Washington.
  37. 37.
    Watson MR, Shirazi N, Marnerides AK, Mauthe A, Hutchison D (2016) Malware detection in cloud computing infrastructures. IEEE Trans Dependable Secure Comput 13(2):192–205. CrossRefGoogle Scholar
  38. 38.
    Xie M, Hu J, Guo S (2015) Segment-based anomaly detection with approximated sample covariance matrix in wireless sensor networks. IEEE Trans Parallel Distrib Syst 26(2):574–583. CrossRefGoogle Scholar
  39. 39.
    Yin H, Song D, Egele M, Kruegel C, Kirda E (2007) Panorama: capturing system-wide information flow for malware detection and analysis. In: Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS), pp 116–127. ACM, New York.
  40. 40.
    Zhang Y, Du B, Zhang L, Wang S (2016) A low-rank and sparse matrix decomposition-based Mahalanobis distance method for hyperspectral anomaly detection. IEEE Trans Geosci Remote Sens 54(3):1376–1389. CrossRefGoogle Scholar

Copyright information

© Springer Science+Business Media, LLC, part of Springer Nature 2019

Authors and Affiliations

  1. 1.Department of Computer EngineeringTarbiat Modares UniversityTehranIran

Personalised recommendations