Real-Time Multi-Modal Subcomponent-Level Measurements for Trustworthy System Monitoring and Malware Detection Article Swipe

MAKE IMPACT

Farshad Khorrami , Ramesh Karri , P. Krishnamurthy · YOU? · · 2025 · Open Access · · DOI: https://doi.org/10.48550/arxiv.2501.13081

With increasingly sophisticated cyber-adversaries able to access a wider repertoire of mechanisms to implant malware such as ransomware, CPU/GPU keyloggers, and stealthy kernel rootkits, there is an urgent need for techniques to detect and mitigate such attacks. While state of the art relies on digital and analog side channel measurements assuming trustworthiness of measurements obtained on the main processor, such an approach has limitations since processor-based side channel measurements are potentially untrustworthy. Sophisticated adversaries (especially in late stage cyber attacks when they have breached the computer and network security systems such as firewalls and antivirus and penetrated the computer's OS) can compromise user-space and kernel-space measurements. To address this key limitation of state of the art, we propose a "subcomponent-level" approach to collect side channel measurements so as to enable robust anomaly detection in a modern computer even when the main processor is compromised. Our proposed approach leverages the fact that modern computers are complex systems with multiple interacting subcomponents and measurements from subcomponents can be used to detect anomalies even when the main processor is no longer trustworthy. We develop mechanisms to obtain time series measurements of activity of several subcomponents and methodologies to process and fuse these measurements for anomaly detection. The subcomponents include network interface controller, GPU, CPU Hardware Performance Counters, CPU power, and keyboard. Our main hypothesis is that subcomponent measurements can enable detection of security threats without requiring a trustworthy main processor. By enabling real-time measurements from multiple subcomponents, the goal is to provide a deeper visibility into system operation, thereby yielding a powerful tool to track system operation and detect anomalies.

Type

preprint

Language

en

Landing Page

http://arxiv.org/abs/2501.13081

PDF

https://arxiv.org/pdf/2501.13081

OA Status

green

Related Works

10

OpenAlex ID

https://openalex.org/W4406780041

Raw OpenAlex JSON

OpenAlex ID

https://openalex.org/W4406780041

Canonical identifier for this work in OpenAlex

DOI

https://doi.org/10.48550/arxiv.2501.13081

Digital Object Identifier

Title

Real-Time Multi-Modal Subcomponent-Level Measurements for Trustworthy System Monitoring and Malware Detection

Work title

Type

preprint

OpenAlex work type

Language

en

Primary language

Publication year

2025

Year of publication

Publication date

2025-01-22

Full publication date if available

Authors

Farshad Khorrami, Ramesh Karri, P. Krishnamurthy

List of authors in order

Landing page

https://arxiv.org/abs/2501.13081

Publisher landing page

PDF URL

https://arxiv.org/pdf/2501.13081

Direct link to full text PDF

Open access

Yes

Whether a free full text is available

OA status

green

Open access status per OpenAlex

OA URL

https://arxiv.org/pdf/2501.13081

Direct OA link when available

Concepts

Modal, Trustworthiness, Malware, Computer science, Real-time computing, Artificial intelligence, Data mining, Computer security, Econometrics, Mathematics, Chemistry, Polymer chemistry

Top concepts (fields/topics) attached by OpenAlex

Cited by

0

Total citation count in OpenAlex

Related works (count)

10

Other works algorithmically related by OpenAlex

Full payload