Hardware-assisted malware detection using explainable machine learning

1. A malware detection system comprising:

a memory; and

a hardware processor of a computing device operatively coupled to the memory, the hardware processor configured to:

execute a software application suspected of being malware;

monitor behavior of the software application at run-time over a plurality of data cycles;

acquire an input time sequence of data records based on a trace analysis of the software application, wherein the input time sequence comprises a plurality of features of the software application;

classify the software application as being a malicious software application based on the plurality of features of the software application;

select a subset of the plurality of features that contributed towards the classification of the software application as being a malicious software application;

generate a ranking of the subset of the plurality of features by their respective contributions towards the classification of the software application as being a malicious software application;

perform outlier elimination for improved classification of the software application as being a malicious software application; and

output the classification of the software application and the ranking of the subset of the plurality of features.

2. The system of claim 1 , wherein the hardware processor uses a recurrent neural network model to classify the software application and rank the subset of the plurality of features.

3. The system of claim 2 , wherein the recurrent neural network is composed of Gated Recurrent Units.

4. The system of claim 1 , wherein the selection of the subset of the plurality of features is performed by perturbing an individual input time sequence and observing a change in output of the individual input time sequence.

5. The system of claim 1 , wherein the hardware processor is further configured to output an indication of time information about when malicious behavior happened within execution of the software application.

6. The system of claim 1 , wherein the input time sequence comprises processor register values at respective clock cycles.

7. The system of claim 6 , wherein the hardware processor is further configured to format the input time sequence in a ω×d table, where ω is a respective processor register value and d is a respective clock cycle, wherein each column of the table forms an individual feature of the plurality of features.

8. The system of claim 6 , wherein the hardware processor is further configured to format the input time sequence in a ω×d table, where ω is a respective processor register value and d is a respective clock cycle, wherein each row of the table forms an individual feature of the plurality of features.

9. The system of claim 1 , wherein the hardware processor is further configured to:

execute a second software application;

monitor behavior of the second software application at run-time over a plurality of data cycles;

acquire a second input time sequence of data records based on a trace analysis of the second software application, wherein the second input time sequence comprises a plurality of features of the second software application; and

classify the second software application as being benign based on the plurality of features of the second software application.

10. The system of claim 1 , further comprising at least one hardware module, wherein the at least one hardware module comprises a hardware performance counter or a design-for-debug structure that assists in the trace analysis of the software application.

11. A malware detection method comprising:

executing, by a computing device, a software application suspected of being malware;

monitoring, by the computing device, behavior of the software application at run-time over a plurality of data cycles;

acquiring, by the computing device, an input time sequence of data records based on a trace analysis of the software application, wherein the input time sequence comprises a plurality of features of the software application;

classifying, by the computing device, the software application as being a malicious software application based on the plurality of features of the software application;

selecting, by the computing device, a subset of the plurality of features that contributed towards the classification of the software application as being a malicious software application;

generating, by the computing device, a ranking of the subset of the plurality of features by their respective contributions towards the classification of the software application as being a malicious software application;

performing, by the computing device, outlier elimination for improved classification of the software application as being a malicious software application; and

outputting, by the computing device, the classification of the software application and the ranking of the subset of the plurality of features.

12. The method of claim 11 , wherein a recurrent neural network model is used by the computing device to classify the software application and rank the subset of the plurality of features.

13. The method of claim 11 , wherein the selection of the subset of the plurality of features is performed by perturbing an individual input time sequence and observing a change in output of the individual input time sequence.

14. The method of claim 11 , further comprising outputting, by the computing device, an indication of time information about when malicious behavior happened within execution of the software application.

15. The method of claim 11 , wherein the input time sequence comprises register values of a processor of the computing device at respective clock cycles.

16. The method of claim 15 , further comprising formatting, by the computing device, the input time sequence in a ω×d table, where ω is a respective register value and d is a respective clock cycle, wherein each column of the table forms an individual feature of the plurality of features.

17. The method of claim 15 , further comprising formatting, by the computing device, the input time sequence in a ω×d table, where ω is a respective processor register value and d is a respective clock cycle, wherein each row of the table forms an individual feature of the plurality of features.

18. The method of claim 11 , further comprising:

executing, by the computing device, a second software application;

monitoring, by the computing device, behavior of the second software application at run-time over a plurality of data cycles;

acquiring, by the computing device, a second input time sequence of data records based on a trace analysis of the second software application, wherein the second input time sequence comprises a plurality of features of the second software application; and

classifying, by the computing device, the second software application as being benign based on the plurality of features of the second software application.

19. A non-transitory computer readable storage medium having instructions stored thereon that, in response to execution by a computing device, cause the computing device to perform operations comprising:

executing a software application suspected of being malware;

monitoring behavior of the software application at run-time over a plurality of data cycles;

acquiring an input time sequence of data records based on a trace analysis of the software application, wherein the input time sequence comprises a plurality of features of the software application;

classifying the software application as being a malicious software application based on the plurality of features of the software application;

selecting a subset of the plurality of features that contributed towards the classification of the software application as being a malicious software application;

generating a ranking of the subset of the plurality of features by their respective contributions towards the classification of the software application as being a malicious software application;

performing outlier elimination for improved classification of the software application as being a malicious software application; and

outputting the classification of the software application and the ranking of the subset of the plurality of features.

20. The non-transitory computer readable storage medium of claim 19 , wherein the operations further comprise:

executing a second software application;

monitoring behavior of the second software application at run-time over a plurality of data cycles;

acquiring a second input time sequence of data records based on a trace analysis of the second software application, wherein the second input time sequence comprises a plurality of features of the second software application; and

classifying the second software application as being benign based on the plurality of features of the second software application.