Visible to the public PREEMPT: PReempting Malware by Examining Embedded Processor Traces

TitlePREEMPT: PReempting Malware by Examining Embedded Processor Traces
Publication TypeConference Paper
Year of Publication2019
AuthorsBasu, Kanad, Elnaggar, Rana, Chakrabarty, Krishnendu, Karri, Ramesh
Conference Name2019 56th ACM/IEEE Design Automation Conference (DAC)
Date PublishedJune 2019
ISBN Number978-1-4503-6725-7
Keywordsanti-virus software tools, computer viruses, Databases, debug hardware component, embedded processor traces, Embedded systems, embedded trace buffer, ETB, Hardware, Hardware performance counters, hardware-level observations, HPC, I-O Systems, i-o systems security, invasive software, learning (artificial intelligence), low-latency technique, machine learning-based classifiers, Malware, malware detection, post-silicon validation, PREEMPT malware, processor traces, program debugging, pubcrawl, Real-time Systems, Scalability, security, software-based AVS, Tools, zero overhead

Anti-virus software (AVS) tools are used to detect Malware in a system. However, software-based AVS are vulnerable to attacks. A malicious entity can exploit these vulnerabilities to subvert the AVS. Recently, hardware components such as Hardware Performance Counters (HPC) have been used for Malware detection. In this paper, we propose PREEMPT, a zero overhead, high-accuracy and low-latency technique to detect Malware by re-purposing the embedded trace buffer (ETB), a debug hardware component available in most modern processors. The ETB is used for post-silicon validation and debug and allows us to control and monitor the internal activities of a chip, beyond what is provided by the Input/Output pins. PREEMPT combines these hardware-level observations with machine learning-based classifiers to preempt Malware before it can cause damage. There are many benefits of re-using the ETB for Malware detection. It is difficult to hack into hardware compared to software, and hence, PREEMPT is more robust against attacks than AVS. PREEMPT does not incur performance penalties. Finally, PREEMPT has a high True Positive value of 94% and maintains a low False Positive value of 2%.

Citation Keybasu_preempt_2019