Malware Detection with Convolutional Neural Network Using Hardware Events

Detection of malicious programs (i.e., malwares) is a great challenge due to increasing amount and variety of attacks. Recent works have shown that machine learning, especially neural network, performs well in malware detection. In this paper, convolution neural network (CNN) is used to build the malware classification model. Different from other works, our work uses hardware events to generate the feature image of programs. These hardware events, such as cache miss rate, branch misprediction rate, can be collected from the performance counter in the Intel CPUs. We train CNN with kinds of data sizes and kernel sizes, and evaluate the result by the area under a receiver operating characteristics (ROC) curve (AUC). The results show the proposed classification model can achieve AUC = 0.9973 in best case and the influence by the data size or kernel size is very little. Moreover, by comparison with other CNNs trained with software-based features, it is indicated that the proposed model has higher accuracy than the other ones.