On the feasibility of online malware detection with performance counters

By J. Demme, Matthew Maycock, J. Schmitz, Adrian Tang, A. Waksman, Simha Sethumadhavan, Salvatore J. Stolfo. 2013

490 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Software, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Software

In Signal Processing

Citations in the corpus

Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations (2018, background): “HPCs have been demonstrated to be useful in detecting malware [11, 47], cachebased side-channel attacks [10] and cryptomining behavior [41] in clouds and enterprises.”
Mining on Someone Else's Dime: Mitigating Covert Mining Operations in Clouds and Enterprises (2017, methodology): “intervals, the behavior of each phase is much more irregular and possesses a high degree of variance (a finding consistent with prior research [35]).”
Fog computing security: a review of current applications and security solutions (2017, methodology): “One suitable solution would be a physical malware detection device [126] as it would use minimal Fog resources.”
On the Detection of Kernel-Level Rootkits Using Hardware Performance Counters (2017, methodology): “Other works developed a custom HPC collection mechanism [27] and/or ran directly on bare hardware [6].”
Robust Malware Detection for Internet of (Battlefield) Things Devices Using Deep Eigenspace Learning (2019, methodology): “[21] examined the feasibility of building a malware detector in IoT nodes’ hardware using performance counters as a learning feature and K-Nearest Neighbor, Decision Tree and Random Forest as classifiers.”
Malware Guard Extension: Using SGX to Conceal Cache Attacks (2017, methodology): “We also assume the presence of detection mechanisms using performance counters, to detect malware [49] and microarchitectural attacks [50], which are more targeted to our attack.”
Dynamic Malware Analysis in the Modern Era—A State of the Art Survey (2019, methodology): “Demme et al. [15] developed an unnamed malware detection platform for the detection of Linux rootkits and Android malware using hardware performance counters.”
Flush+Flush: A Fast and Stealthy Cache Attack (2015, background): “In defensive cases, performance counters allow detection of malware [6], integrity checking of programs [26], control ﬂow integrity [44], and binary analysis [43].”
Cyber-physical systems security: Limitations, issues and future trends (2020, unknown): “3) Protecting Digital Evidences: this is highly important since most of the advanced attacks focus on eliminating any source of evidence that traces back to the attack source, such as the case of Shamoon, Duqu, Flame and Stuxnet malware types [404], [109], [75].”