Hardware performance counters based runtime anomaly detection using SVM
Muhamed Fauzi Bin Abbas, Sai Praveen Kadiyala, Alok Prakash, Thambipillai Srikanthan, Yan Lin Aung · 2017
The nature of ever evolving anomalies have become more sophisticated and complex in attacking the defense schemes, thereby leading to serious compromises. Existing software based techniques aim to protect a vulnerable software with another software which is also prone to compromise like obfuscation-based attacks. On the other hand, hardware performance counters offer a robust detection mechanism that is difficult to compromise since it is easier to tamper the software components than hardware features. Hence, in this paper, we propose a hardware-based monitoring method for embedded devices in detecting anomalies using carefully selected low-level hardware features. Next, a support vector machine (SVM) classifier is used to train a model that can detect anomalies based on features obtained from the selected hardware performance counters. Experimental results show that the proposed approach can achieve an accuracy of close to 100% anomaly detection rate while relying only on a single trained model. This approach can be generalized across various platforms.