On the Detection of Kernel-Level Rootkits Using Hardware Performance Counters

Authors: Baljit Singh, Dmitry Evtyushkin, Jesse Elwell, Ryan Riley, Iliano Cervesato - ACM SIGSAC Conference on Computer and Communications Security, CCS 2017 cited by 109

Recent work has investigated the use of hardware performance counters (HPCs) for the detection of malware running on a system. These works gather traces of HPCs for a variety of applications (both malicious and non-malicious) and then apply machine learning to train a detector to distinguish between benign applications and malware. In this work, we provide a more comprehensive analysis of the applicability of using machine learning and HPCs for a specific subset of malware: kernel rootkits.