# EMMA: A New Platform to Evaluate Hardware-based Mobile Malware Analyses

arXiv: https://arxiv.org/abs/1603.03086 · HTML: https://mlsanity.com/paper/1603.03086/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Mar 2016.

## Built on by (most cited first, 2 of 2)

- [Stochastic-HMDs: Adversarial Resilient Hardware Malware Detectors through Voltage Over-scaling](https://mlsanity.com/paper/2103.06936/) (2021)
- [PDF-Malware: An Overview on Threats, Detection and Evasion Attacks](https://mlsanity.com/paper/2107.12873/) (2021)

## Abstract (arXiv)

Hardware-based malware detectors (HMDs) are a key emerging technology to build trustworthy computing platforms, especially mobile platforms. Quantifying the efficacy of HMDs against malicious adversaries is thus an important problem. The challenge lies in that real-world malware typically adapts to defenses, evades being run in experimental settings, and hides behind benign applications. Thus, realizing the potential of HMDs as a line of defense - that has a small and battery-efficient code base - requires a rigorous foundation for evaluating HMDs. To this end, we introduce EMMA - a platform to evaluate the efficacy of HMDs for mobile platforms. EMMA deconstructs malware into atomic, orthogonal actions and introduces a systematic way of pitting different HMDs against a diverse subset of malware hidden inside benign applications. EMMA drives both malware and benign programs with real user-inputs to yield an HMD's effective operating range - i.e., the malware actions a particular HMD is capable of detecting. We show that small atomic actions, such as stealing a Contact or SMS, have surprisingly large hardware footprints, and use this insight to design HMD algorithms that are less intrusive than prior work and yet perform 24.7% better. Finally, EMMA brings up a surprising new result - obfuscation techniques used by malware to evade static analyses makes them more detectable using HMDs.