On the Performance of Malware Detection Classifiers Using Hardware Performance Counters

• URL: http://arxiv.org/abs/2608.02671v1
• Date: Sun, 02 Aug 2026 14:28:54 GMT
• Title: On the Performance of Malware Detection Classifiers Using Hardware Performance Counters
• Abstract summary: Hardware-based malware detectors (HMD) use Machine Learning (ML) classifiers to detect malicious application patterns.<n>This paper proposes malware detection using HPCs and machine learning classifiers.<n>We use ensemble learning techniques to improve the performance of the hardware-based malware detectors.
• Score: 0.36944296923226316
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Malware detection using Hardware Performance Counters (HPC) has emerged as a promising solution to improve the security of computing systems as a complement to antivirus software. Hardware-based malware detectors (HMD) use Machine Learning (ML) classifiers to detect malicious application patterns. The inputs to ML classifiers are low-level performance features known as HPCs, hardware-related activity data collected from a processor at run time to profile the low-level microarchitectural behavior of an application. This paper proposes malware detection using HPCs and machine learning classifiers and highlights the effectiveness of malware detection at run-time. We use ensemble learning techniques to improve the performance of the hardware-based malware detectors, which reduces the number of necessary micro-architectural events. This improves the processor's efficiency by eliminating the need to run an application several times since a processor can measure only 2 to 8 events at a cycle. We use 18 machine-learning models along with two ensemble learning methods to evaluate the malware detection performance, creating a total of 144 different configurations. The experimental results show that the ensemble learning-based malware detection with 2 HPCs using the ensemble technique outperforms standard classifiers with 8 HPCs by up to 10%. It also matches the performance of standard ML-based detectors that use 16 HPCs while requiring only 4 HPCs, thereby enabling effective run-time malware detection.

Related papers

• Performance analysis of Machine learning algorithms for predicting malware [0.0]
  Malware poses a persistent and evolving threat to modern computing systems.<n>Traditional signature-based antivirus solutions often fail to identify newly emerging malware.<n>This study proposes a machine learning-based malware detection framework.
  arXiv  Detail & Related papers  (2026-08-03T03:24:58Z)
• RockNet: Distributed Learning on Ultra-Low-Power Devices [49.01692357536576]
  This paper presents RockNet, a new TinyML method tailored for ultra-low-power hardware.<n>By leveraging that CPS consist of multiple devices, we design a distributed learning method that integrates Machine Learning and wireless communication.<n>Our results show that a tight integration of distributed ML, distributed computing, and communication enables, for the first time, training on ultra-low-power hardware with state-of-the-art accuracy.
  arXiv  Detail & Related papers  (2025-10-15T09:09:30Z)
• DetectAnyLLM: Towards Generalizable and Robust Detection of Machine-Generated Text Across Domains and Models [60.713908578319256]
  We propose Direct Discrepancy Learning (DDL) to optimize the detector with task-oriented knowledge.<n>Built upon this, we introduce DetectAnyLLM, a unified detection framework that achieves state-of-the-art MGTD performance.<n>MIRAGE samples human-written texts from 10 corpora across 5 text-domains, which are then re-generated or revised using 17 cutting-edge LLMs.
  arXiv  Detail & Related papers  (2025-09-15T10:59:57Z)
• Certifiably robust malware detectors by design [48.367676529300276]
  We propose a new model architecture for robust malware detection by design.<n>We show that every robust detector can be decomposed into a specific structure, which can be applied to learn empirically robust malware detectors.<n>Our framework ERDALT is based on this structure.
  arXiv  Detail & Related papers  (2025-08-10T09:19:29Z)
• Detecting Hardware Trojans in Microprocessors via Hardware Error Correction Code-based Modules [49.1574468325115]
  Hardware Trojans (HTs) enable attackers to execute unauthorized software or gain illicit access to privileged operations.<n>This manuscript introduces a hardware-based methodology for detecting runtime HT activations using Error Correction Codes (ECCs) on a RISC-V microprocessor.
  arXiv  Detail & Related papers  (2025-06-18T12:37:14Z)
• A Survey of Malware Detection Using Deep Learning [6.349503549199403]
  This paper investigates advances in malware detection on Windows, iOS, Android, and Linux using deep learning (DL) We discuss the issues and the challenges in malware detection using DL classifiers. We examine eight popular DL approaches on various datasets.
  arXiv  Detail & Related papers  (2024-07-27T02:49:55Z)
• Small Effect Sizes in Malware Detection? Make Harder Train/Test Splits! [51.668411293817464]
  Industry practitioners care about small improvements in malware detection accuracy because their models are deployed to hundreds of millions of machines. Academic research is often restrained to public datasets on the order of ten thousand samples. We devise an approach to generate a benchmark of difficulty from a pool of available samples.
  arXiv  Detail & Related papers  (2023-12-25T21:25:55Z)
• Can Feature Engineering Help Quantum Machine Learning for Malware Detection? [7.010669841466896]
  We propose a hybrid framework of theoretical Quantum ML to address this problem. VQC with XGBoost selected features can get a 78.91% test accuracy on the simulator. The average accuracy for the model trained using the features selected with XGBoost was 74%.
  arXiv  Detail & Related papers  (2023-05-03T19:33:49Z)
• Comprehensive Efficiency Analysis of Machine Learning Algorithms for Developing Hardware-Based Cybersecurity Countermeasures [0.0]
  Modern computing systems have led cyber adversaries to create more sophisticated malware than was previously available. Modern detection techniques use the machine learning field and hardware to boost the detection rates of malicious software. A problem emerges when malware with no comparable HPC values comes into contact with these new techniques.
  arXiv  Detail & Related papers  (2022-01-05T22:08:57Z)
• ML-based IoT Malware Detection Under Adversarial Settings: A Systematic Evaluation [9.143713488498513]
  This work systematically examines the state-of-the-art malware detection approaches, that utilize various representation and learning techniques. We show that software mutations with functionality-preserving operations, such as stripping and padding, significantly deteriorate the accuracy of such detectors.
  arXiv  Detail & Related papers  (2021-08-30T16:54:07Z)
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection [67.53296659361598]
  adversarial EXEmples can bypass machine learning-based detection by perturbing relatively few input bytes. We develop a unifying framework that does not only encompass and generalize previous attacks against machine-learning models, but also includes three novel attacks. These attacks, named Full DOS, Extend and Shift, inject the adversarial payload by respectively manipulating the DOS header, extending it, and shifting the content of the first section.
  arXiv  Detail & Related papers  (2020-08-17T07:16:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.