# Comprehensive Efficiency Analysis of Machine Learning Algorithms for Developing Hardware-Based Cybersecurity Countermeasures

arXiv: https://arxiv.org/abs/2201.07654 · HTML: https://mlsanity.com/paper/2201.07654/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 42 references that are in the map.
- First posted on arXiv 5 Jan 2022.

## Builds on (most cited first, 8 of 8)

- [Explaining Explanations: An Overview of Interpretability of Machine Learning](https://mlsanity.com/paper/1806.00069/) (2018)
- [Spectre Attacks: Exploiting Speculative Execution](https://mlsanity.com/paper/1801.01203/) (2018)
- [Unsupervised Anomaly-based Malware Detection using Hardware Features](https://mlsanity.com/paper/1403.1631/) (2014)
- [Turning Internet of Things(IoT) into Internet of Vulnerabilities (IoV) : IoT Botnets](https://mlsanity.com/paper/1702.03681/) (2017)
- [Meltdown](https://mlsanity.com/paper/1801.01207/) (2018)
- [Defending Hardware-based Malware Detectors against Adversarial Attacks](https://mlsanity.com/paper/2005.03644/) (2020)
- [Transferable Cost-Aware Security Policy Implementation for Malware Detection Using Deep Reinforcement Learning](https://mlsanity.com/paper/1905.10517/) (2019)
- [Malware Detection at the Microarchitecture Level using Machine Learning Techniques](https://mlsanity.com/paper/2005.12019/) (2020)

## Abstract (arXiv)

Modern computing systems have led cyber adversaries to create more sophisticated malware than was previously available in the early days of technology. Dated detection techniques such as Anti-Virus Software (AVS) based on signature-based methods could no longer keep up with the demand that computer systems required of them. The complexity of modern malware has led to the development of contemporary detection techniques that use the machine learning field and hardware to boost the detection rates of malicious software. These new techniques use Hardware Performance Counters (HPCs) that form a digital signature of sorts. After the models are fed training data, they can reference these HPCs to classify zero-day malware samples. A problem emerges when malware with no comparable HPC values comes into contact with these new techniques. We provide an analysis of several machine learning and deep learning models that run zero-day samples and evaluate the results from the conversion of C++ algorithms to a hardware description language (HDL) used to begin a hardware implementation. Our results present a lack of accuracy from the models when running zero-day malware data as our highest detector, decision tree, was only able to reach 91.2% accuracy and had an F1-Score of 91.5% in the form of a decision tree. Next, through the Receiver Operating Curve (ROC) and area-under-the-curve (AUC), we can also determine that the algorithms did not present significant robustness as the largest AUC was only 0.819. In addition, we viewed relatively high overhead for our ensemble learning algorithm while also only having an 86.3% accuracy and 86% F1-Score. Finally, as an additional task, we adapted the one rule algorithm to fit many rules to make malware classification understandable to everyday users by allowing them to view the regulations while maintaining relatively high accuracy.