CARE: Enabling Hardware Performance Counter based Malware Detection Resilient to System Resource Competition

Abstract

Hardware performance counter (HPC) has been widely used for learning based malware detection model because of its light-weight overhead and universality. Unfortunately, we find that such detection models are susceptible to the fluctuation of HPC caused by resource competition among programs. Hence, detecting malware based on HPC effectively is tricky in the actual multitasking environments. In this paper, we propose CARE, a framework to enable hardware performance counter based malware detection models resilient to resource competition. The key idea of CARE is to take full advantage of typical HPC-level behaviors (i.e., the behavior of the program itself stable and the resource competition always on) in resource competition environments to extract the invariant hidden behind HPC-level behaviors. We first design a benchmark based resource pressure generator to generate controlled resource competition environment for observing typical HPC-level behavior of a program in resource competition environments. We then train a behavior representation network to map HPC-level behaviors in any competition environment into a lowdimensional representations for malware detection. Utilizing three datasets collected with different resource competition types or levels in different application systems (e.g., server or desktop), we show that CARE helps detection models improve their malware detection performance in competition environment. We also demonstrate models with CARE outperform existing detection models and are not sensitive to different application systems. Finally, we demonstrate the strong robustness of CARE and its acceptable computational overhead.