Detection of malware cyber-attacks at the processor microarchitecture level
has recently emerged as a promising solution to enhance the security of
computer systems. Security mechanisms, such as hardware-based malware
detection, use machine learning algorithms to classify and detect malware with
the aid of Hardware Performance Counters (HPCs) information. The ML classifiers
are fed microarchitectural data extracted from Hardware Performance Counters
(HPCs), which contain behavioral data about a software program. These HPCs are
captured at run-time to model the program's behavior. Since the amount of HPCs
are limited per processor, many techniques employ feature reduction to reduce
the amount of HPCs down to the most essential attributes. Previous studies have
already used binary classification to implement their malware detection after
doing extensive feature reduction. This results in a simple identification of
software being either malware or benign. This research comprehensively analyzes
different hardware-based malware detectors by comparing different machine
learning algorithms' accuracy with binary and multi-class classification
models. Our experimental results indicate that when compared to complex machine
learning models (e. g. Neural Network and Logistic), light-weight J48 and JRip
algorithms perform better in detecting the malicious patterns even with the
introduction of multiple types of malware. Although their detection accuracy
slightly lowers, their robustness (Area Under the Curve) is still high enough
that they deliver a reasonable false positive rate.