Unsupervised anomaly-based malware detection using hardware features

Abstract

Disclosed are devices, systems, apparatus, methods, products, media and other implementations, including a method that includes obtaining current hardware performance data, including hardware performance counter data, for a hardware device executing a first process associated with pre-recorded hardware performance data representative of the first process' normal behavior, and determining whether a malicious process is affecting performance of the first process based on a determination of an extent of deviation of the obtained current hardware performance data corresponding to the first process from the pre-recorded hardware performance data representative of the normal behavior of the first process.

What is claimed is: 
     
         1 . A method for unsupervised detection of anomalous processes, the method comprising:
 obtaining current hardware data, including hardware time-varying counter data obtained over a period of time, representative of a time-series trace of micro-architectural events for a hardware device executing a first process, the first process being associated with pre-recorded hardware data representative of a normal time-series trace of micro-architectural events corresponding to normal behavior of the first process;   determining an extent of deviation of the obtained current hardware data from the pre-recorded hardware data representative of the normal time-series trace of micro-architectural events corresponding to the normal behavior of the first process; and   determining based on the extent of deviation whether an anomalous process is affecting performance of the first process.   
     
     
         2 . The method of  claim 1 , further comprising:
 applying one or more transform functions to at least the current hardware data to generate transformed data;   wherein determining whether the anomalous process is affecting the performance of the first process comprises determining whether the anomalous process is affecting the performance of the first process based on the extent of deviation of the transformed data generated from the current hardware data, from the pre-recorded hardware data.   
     
     
         3 . The method of  claim 2 , wherein applying the one or more transform functions to the current hardware data to generate the transformed data comprises:
 deriving a normalized hardware value, normalized i , for an event i, from hardware data value, raw i , for the event i, according to:   
       
         
           
             
               
                 normalized 
                 i 
               
               = 
               
                 
                   ( 
                   
                     
                       
                         raw 
                         i 
                       
                       - 
                       
                         min 
                         i 
                       
                     
                     
                       max 
                       i 
                     
                   
                   ) 
                 
                 
                   λ 
                   i 
                 
               
             
           
         
       
       where min i  and max i  are respective minimum and maximum values for the event i, and λ i  is a power parameter for the event i. 
     
     
         4 . The method of  claim 3 , wherein λ i  has a respective value determined so that a normalized distribution of the transformed hardware data, obtained over the period of time for the event i, has a median value that magnifies deviations of anomalous hardware data for the event i from normal hardware data for the event i. 
     
     
         5 . The method of  claim 2 , further comprising:
 applying the one or more transform functions to the pre-recorded hardware data.   
     
     
         6 . The method of  claim 1 , wherein obtaining the current hardware data comprises:
 identifying a set of hardware data from available current hardware data based at least on quantitative measures of how effective one or more features associated with the current hardware data can discriminate between hardware data obtained during clean execution of a victim process and hardware data obtained during infected execution of the victim process; and   aggregating the identified set of hardware data to produce the obtained current hardware data.   
     
     
         7 . The method of  claim 6 , wherein the quantitative measures are computed for both an exploitation stage and a take-over stage of a multi-stage malware infection that hijacks control of the victim process, and wherein the quantitative measures taken at both the exploitation stage and the take-over stage cause the determination of which features are most useful in differentiating clean execution for the victim process from infected execution of the victim process 
     
     
         8 . The method of  claim 6 , wherein the quantitative measures comprise Fisher scores. 
     
     
         9 . The method of  claim 1 , wherein obtaining the hardware data comprises:
 obtaining the hardware data at various time instances.   
     
     
         10 . The method of  claim 9 , wherein obtaining the hardware data at the various time instances comprises:
 performing one or more of a data push operation initiated by the hardware device to send the current hardware data, or a data pull operation, initiated by an antivirus engine, to cause the current hardware data to be sent by the hardware device.   
     
     
         11 . The method of  claim 1 , wherein determining an extent of deviation of the obtained current hardware data from the pre-recorded hardware data comprises:
 applying one or more machine-learning procedures, trained using the pre-recorded hardware data representative of the normal time-series trace of micro-architectural events corresponding to the normal behavior of the first process, to the current hardware data to determine whether the current hardware data for the hardware device executing the first process deviates from the pre-recorded hardware data for the first process.   
     
     
         12 . The method of  claim 11 , wherein the one or more machine learning procedures comprise one or more of: a support vector machine implementing a non-linear radial basis function (RBF) kernel, a k-nearest neighbor procedure, a decision tree procedure, a random forest procedure, an artificial neural network procedure, a tensor density procedure, or a hidden Markov model procedure. 
     
     
         13 . The method of  claim 1 , wherein the current hardware data comprises one or more of:
 processor load density data, branch prediction data, or data regarding instruction cache misses.   
     
     
         14 . The method of  claim 1 , further comprising:
 obtaining updates for at least the pre-recorded hardware data, wherein obtaining the updates comprises:
 downloading encrypted data for the updates to an antivirus engine in communication with the hardware device providing the current hardware data; 
 decrypting at the antivirus engine the downloaded encrypted data for the updates; and 
 updating a revision counter maintained by the antivirus engine indicating a revision number of a most recent update. 
   
     
     
         15 . A system for unsupervised anomaly-based malware detection using hardware features, the system comprising:
 a hardware device executing a first process; and   an antivirus engine in communication with the hardware device, the antivirus engine configured to:
 obtain current hardware data, including hardware time-varying counter data obtained over a period of time, representative of a time-series trace of micro-architectural events for the hardware device executing the first process, the first process being associated with pre-recorded hardware data representative of a normal time-series trace of micro-architectural events corresponding to normal behavior of the first process; 
 determine an extent of deviation of the obtained current hardware data from the pre-recorded hardware data representative of the normal time-series trace of micro-architectural events corresponding to the normal behavior of the first process; and 
 determine based on the extent of deviation whether an anomalous process is affecting performance of the first process. 
   
     
     
         16 . The system of  claim 15 , wherein the antivirus engine is further configured to:
 apply one or more transform functions to at least the current hardware data to generate transformed data;   wherein the antivirus engine configured to determine whether the anomalous process is affecting the performance of the first process is configured to determine whether the anomalous process is affecting the performance of the first process based on the extent of deviation of the transformed data generated from the current hardware data, from the pre-recorded hardware data.   
     
     
         17 . The system of  claim 16 , wherein the antivirus engine configured to apply the one or more transform functions to the current hardware data to generate the transformed data is configured to:
 derive a normalized hardware value, normalized i , for an event i, from hardware data value, raw i , for the event i, according to:   
       
         
           
             
               
                 normalized 
                 i 
               
               = 
               
                 
                   ( 
                   
                     
                       
                         raw 
                         i 
                       
                       - 
                       
                         min 
                         i 
                       
                     
                     
                       max 
                       i 
                     
                   
                   ) 
                 
                 
                   λ 
                   i 
                 
               
             
           
         
         where min i  and max i  are respective minimum and maximum values for the event i, and λ i  is a power parameter for the event i. 
       
     
     
         18 . The system of  claim 15 , wherein the antivirus engine configured to obtain the current hardware data is configured to:
 identify a set of hardware data from available current hardware data based at least on quantitative measures of how effective one or more features associated with the current hardware data can discriminate between hardware data obtained during clean execution of a victim process and hardware data obtained during infected execution of the victim process; and   aggregate the identified set of hardware data to produce the obtained current hardware data.   
     
     
         19 . The system of  claim 15 , wherein the antivirus engine configured to determine the extent of deviation of the obtained current hardware data from the pre-recorded hardware data is configured to:
 apply one or more machine-learning procedures, trained using the pre-recorded hardware data representative of the normal time-series trace of micro-architectural events corresponding to the normal behavior of the first process, to the current hardware data to determine whether the current hardware data for the hardware device executing the first process deviates from the pre-recorded hardware data for the first process.   
     
     
         20 . A non-transitory computer readable media comprising computer instructions executable on a programmable device to:
 obtain current hardware data, including hardware time-varying counter data obtained over a period of time, representative of a time-series trace of micro-architectural events for a hardware device executing a first process, the first process being associated with pre-recorded hardware data representative of a normal time-series trace of micro-architectural events corresponding to normal behavior of the first process;   determine an extent of deviation of the obtained current hardware data from the pre-recorded hardware data representative of the normal time-series trace of micro-architectural events corresponding to the normal behavior of the first process; and   determine based on the extent of deviation whether an anomalous process is affecting performance of the first process.