# Unsupervised Anomaly-based Malware Detection using Hardware Features

arXiv: https://arxiv.org/abs/1403.1631 · HTML: https://mlsanity.com/paper/1403.1631/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Mar 2014.

## Built on by (most cited first, 8 of 8)

- [A Survey of Machine Learning for Computer Architecture and Systems](https://mlsanity.com/paper/2102.07952/) (2021)
- [Self-Supervised Vision Transformers for Malware Detection](https://mlsanity.com/paper/2208.07049/) (2022)
- [Empirical Evaluation of Concept Drift in ML-Based Android Malware Detection](https://mlsanity.com/paper/2507.22772/) (2025)
- [PDF-Malware: An Overview on Threats, Detection and Evasion Attacks](https://mlsanity.com/paper/2107.12873/) (2021)
- [Comprehensive Efficiency Analysis of Machine Learning Algorithms for Developing Hardware-Based Cybersecurity Countermeasures](https://mlsanity.com/paper/2201.07654/) (2022)
- [Firenze: Model Evaluation Using Weak Signals](https://mlsanity.com/paper/2207.00827/) (2022)
- [Enhancing Efficiency and Privacy in Memory-Based Malware Classification through Feature Selection](https://mlsanity.com/paper/2310.00516/) (2023)
- [On the Generalizability of Machine Learning-based Ransomware Detection in Block Storage](https://mlsanity.com/paper/2412.21084/) (2024)

## Abstract (arXiv)

Recent works have shown promise in using microarchitectural execution patterns to detect malware programs. These detectors belong to a class of detectors known as signature-based detectors as they catch malware by comparing a program's execution pattern (signature) to execution patterns of known malware programs. In this work, we propose a new class of detectors - anomaly-based hardware malware detectors - that do not require signatures for malware detection, and thus can catch a wider range of malware including potentially novel ones. We use unsupervised machine learning to build profiles of normal program execution based on data from performance counters, and use these profiles to detect significant deviations in program behavior that occur as a result of malware exploitation. We show that real-world exploitation of popular programs such as IE and Adobe PDF Reader on a Windows/x86 platform can be detected with nearly perfect certainty. We also examine the limits and challenges in implementing this approach in face of a sophisticated adversary attempting to evade anomaly-based detection. The proposed detector is complementary to previously proposed signature-based detectors and can be used together to improve security.