RHMD: Evasion-Resilient Hardware Malware Detectors Khaled N. Khasawneh*, Nael Abu-Ghazaleh*, Dmitry Ponomarev**, Lei Yu** University of California, Riverside *, Binghamton University ** MICRO 2017 – Boston, USA, October 2017

Malware is Everywhere!

Over 250,000 malware registered every day! Malware is Everywhere! Over 250,000 malware registered every day!

Traditional Software Malware Detection Static malware detection Search for signatures in the executable Can detect all known malware with no false alarms Can be evaded by new malware and polymorphic malware Dynamic malware detection Monitors the behavior of the program Can detect unknown malware Very high overhead limiting use in practice

Hardware Malware Detectors (HMDs) Use Machine Learning: detect malware as computational anomaly Use low-level features collected from the hardware Can be always-on without adding performance overhead Many research papers including ISCA’13, HPCA’15 and MICRO’16

Paper Contributions Can malware evade HMDs? Reverse-engineer HMDs Develop evasive malware Evade detection after re-training

Can we make HMDs robust to evasion? Paper Contributions Can malware evade HMDs? If yes Can we make HMDs robust to evasion? Reverse-engineer HMDs 1- Provably harder to reverse-engineer 2- Robust to evasion Yes! Using RHMDs Develop evasive malware Evade detection after re-training

Reverse Engineering

How to Reverse Engineer HMDs? Challenges: We don’t know the detection period We don’t know the features used We don’t know the detection algorithm Approach: Train different classifiers Derive specific parameters as an optimization problem

Reverse Engineering HMDs Attacker Training Data _________________________

Reverse Engineering HMDs Victim HMD Attacker Training Data _________________________ 10100 Black box output

Reverse Engineering HMDs Victim HMD Attacker Training Data _________________________ 10100 Black box output Training model Data Labels

Reverse Engineering HMDs Victim HMD Attacker Training Data _________________________ 10100 Black box output Training model Data Labels Reverse-engineered HMD

We Can Guess Detectors Parameters! Victim HMD parameters: - 10K detection period - Instructions features vector

We Can Guess Detectors Parameters! Victim HMD parameters: - 10K detection period - Instructions features vector Guessing detection period: LR: Logistic Regression DT: Decision Tree SVM: Support Vector Machines

We Can Guess Detectors Parameters! Victim HMD parameters: - 10K detection period - Instructions features vector Guessing feature vector: LR: Logistic Regression DT: Decision Tree SVM: Support Vector Machines

Reverse Engineering Effectiveness Logistic Regression Neural Networks

Reverse Engineering Effectiveness Current generation of HMDs can be reverse engineered Logistic Regression Neural Networks

Evading HMDs

How to Create Evasive Malware? Challenges: - We don’t have malware source code - We can’t decompile malware because its obfuscated Our approach: PIN Dynamic Control Flow Graph

What we Should Add to Evade? Logistic Regression (LR) LR is defined by a weight vector θ Add instructions whose weights are negative

What we Should Add to Evade? Neural Network (NN) Collapse the description of the NN into a single vector Add instructions whose weights are negative

What we Should Add to Evade? Current generation of HMDs are vulnerable to evasion attacks! Neural Network (NN) Collapse the description of the NN into a single vector Add instructions whose weights are negative

Does re-training Help?

Can we Retrain with Samples of Evasive Malware? Linear Model Logistic Regression

Can we Retrain with Samples of Evasive Malware? Linear Model Logistic Regression Non-Linear Model Neural Network

Explaining Retraining Performance Linear Model (LR)

Explaining Retraining Performance Non-Linear Model (NN)

What if we Keep Retraining?

What if we Keep Retraining?

What if we Keep Retraining?

What if we Keep Retraining?

What if we Keep Retraining? Re-training is not a general solution

Can we Build Detectors that Resist Evasion?

Overview of RHMDs RHMD HMD 1 HMD 2 Pool of diverse HMDs . HMD n

Overview of RHMDs RHMD HMD 1 HMD 2 Input Output . HMD n Selector

Overview of RHMDs … RHMD . Features vector Input Output Detection period Number of committed instructions … Features vector RHMD HMD 1 HMD 2 Input Output . HMD n Selector

Overview of RHMDs … … RHMD . Features vector Input Output Detection period Number of committed instructions … … Features vector RHMD HMD 1 HMD 2 Input Output . HMD n Selector

Overview of RHMDs … … … RHMD . Features vector Input Output Detection period Number of committed instructions … … … Features vector RHMD HMD 1 HMD 2 Input Output . HMD n Selector

Overview of RHMDs … … … RHMD Diversify by Different: 1- Features Detection period Number of committed instructions … … … Features vector RHMD Diversify by Different: 1- Features 2- Detection periods HMD 1 HMD 2 . HMD n Selector

Reverse Engineer RHMDs Randomizing the features (a) Two feature vectors (b) Three feature vectors

Reverse Engineer RHMDs Randomizing the features and detection period (a) Two feature vectors and two periods (b) Three feature vectors and two periods

RHMD is Resilient to Evasion

Hardware Overhead FPGA prototype on open core (AO486): RHMD with three detectors: Area increase 1.72% Power increase 0.78%

Conclusion Current generation of HMDs vulnerable to evasion Developed a methodology to reverse-engineer and evade detectors Explored Re-training HMDs Benefit is limited Developed new class of Evasion-Resilient HMDs Robust to evasion Low overhead

RAID 2015 – Kyoto, Japan, November 2015 Thank you! Questions? RAID 2015 – Kyoto, Japan, November 2015

Can’t Just Randomly Add Instructions

Evasion Overhead