Hydra：基于硬件的鲁棒恶意软件检测
Hydra: Robust Hardware-Assisted Malware Detection
AI总结：
Hydra通过战略性调度不同特征集提升硬件辅助恶意软件检测的鲁棒性
摘要：
利用硬件性能计数器（HPCs）进行恶意软件检测提供了一种有前途的、低开销的方法来监控程序行为。然而，一个基本的架构限制，即只能同时监控有限数量的硬件事件，导致了显著的瓶颈，产生检测盲区。以往的工作主要集中在优化用于单一静态选定事件集的机器学习模型，或在相同特征集上进行模型集成。我们认为，鲁棒性需要不仅多样化模型，还应多样化底层特征集（即监控的硬件事件），以捕捉更广泛程序行为。这一观察促使以下研究问题：通过在时间上战略性地调度不同的特征集，能否通过牺牲时间粒度来换取更广泛的覆盖，从而提高检测性能？为回答这一问题，我们提出了Hydra，一种新的检测机制，将执行轨迹划分为时间片，并学习有效的时间片特征集和相应分类器的调度方案。通过循环互补的特征集，Hydra缓解了固定监控视角的局限性。我们的实验评估表明，Hydra显著优于最先进的单一特征集基线，实现了F1得分的19.32%提升和假阳性率的60.23%降低。这些结果强调了特征集多样性的的重要性，并确立了战略性多特征集调度作为实现鲁棒、硬件辅助恶意软件检测的有效原则。
英文摘要：
Malware detection using Hardware Performance Counters (HPCs) offers a promising, low-overhead approach for monitoring program behavior. However, a fundamental architectural constraint, that only a limited number of hardware events can be monitored concurrently, creates a significant bottleneck, leading to detection blind spots. Prior work has primarily focused on optimizing machine learning models for a single, statically chosen event set, or on ensembling models over the same feature set. We argue that robustness requires diversifying not only the models, but also the underlying feature sets (i.e., the monitored hardware events) in order to capture a broader spectrum of program behavior. This observation motivates the following research question: Can detection performance be improved by trading temporal granularity for broader coverage, via the strategic scheduling of different feature sets over time? To answer this question, we propose Hydra, a novel detection mechanism that partitions execution traces into time slices and learns an effective schedule of feature sets and corresponding classifiers for deployment. By cycling through complementary feature sets, Hydra mitigates the limitations of a fixed monitoring perspective. Our experimental evaluation shows that Hydra significantly outperforms state-of-the-art single-feature-set baselines, achieving a 19.32% improvement in F1 score and a 60.23% reduction in false positive rate. These results underscore the importance of feature-set diversity and establish strategic multi-feature-set scheduling as an effective principle for robust, hardware-assisted malware detection.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
