Intelligent Malware Detection based on Hardware Performance Counters: A Comprehensive Survey

Hossein Sayadi1, Zhangying He1, Hosein Mohammadi Makrani2, Houman Homayoun3
1California State University, Long Beach, 2University of California, Davis, 3University of California Davis


Abstract

The growing complexity of modern computing systems increases vulnerability to evolving cyber threats. Recent breakthroughs in computer architecture security utilizes Hardware Performance Counters (HPCs) to access low-level application features, presenting a promising solution to the limitations of traditional software-based defenses. Specialized registers in microprocessors capture diverse hardware-related events, demonstrating efficacy in detecting malicious activities through the application of Machine Learning (ML) algorithms. This survey offers a comprehensive analysis of recent advancements in the emerging field of intelligent malware detection based on hardware performance counters, a topic that has garnered significant attention within the research community for the past decade. Additionally, it outlines current challenges and forecasts future research trends, offering insights for efficient ML-based security countermeasures based on microarchitectural features. This work serves as a helpful resource for researchers in hardware and systems security, offering insights into emerging developments and research directions in countering cyber-attacks at the hardware level using ML techniques.