Simulated faults let hardware malware detectors miss malicious execution
Original title: Silent Blindness: Fault Vulnerability of Hardware Malware Detectors
Tree models had a 5.3 percent mean critical-fault fraction versus 14.3 percent for function-based models.
The paper injects structural faults into hardware malware detectors that classify performance-counter measurements. Across 18 classifiers, four counter budgets, and AdaBoost and Bagging ensembles, a fault is critical when malware recall drops by at least five points. Tree models were less critical than function-based models. Protecting 16 of 115 units on a representative J48 detector cut predicted maximum recall loss from 60.1 to 3.3 points.
Unconfirmed: Faulted RTL correspondence and physical hardening overhead remain unvalidated.
- The simulation evaluated 453,174 stuck-at and selected bit-flip events.
- Primary comparisons used 128 completed configurations.
- 72.3 percent of evaluated tree faults shifted recall and false positives by under 0.1 points.
- Bagging reduced criticality in 26 of 27 matched comparisons.
From the original article
1 min read at arxiv.orgHardware malware detectors (HMDs) classify hardware performance-counter measurements to identify malicious execution. Faults in their decision logic or parameters can weaken detection and allow malware to be classified as benign. We investigate this vulnerability through structural fault injection across a design space comprising 18 classifiers, four counter budgets, and AdaBoost and Bagging ensembles.
By Alireza Abolhasani Zeraatkar · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.