PaperlayerView exact revision on arXiv

Source-linked AI summary

Power, Performance, and Area of HPC-Based Malware Detectors: An FPGA and Open-PDK ASIC Study

Alireza Abolhasani Zeraatkar, Parnian Shabani Kamran, Parsa Mirfasihi, Saleh Khalaj Monfared, Hussain Al-Asaad

arXiv:2610.12795v1cs.CRcs.AR

TL;DR

Hardware malware detectors use performance-counter data, but their implementation costs across classifier types and hardware targets remain an open question. The paper reconstructs trained classifiers, generates and validates RTL, and evaluates FPGA and ASIC implementations. Tree- and rule-based detectors show favorable detection-to-cost trade-offs, while reducing HPC inputs can lower area with a detection-performance trade-off.

  • Problem

    Hardware costs across a comprehensive HMD classifier design space on both FPGA and ASIC targets have not been measured, although area, power, and delay affect processor integration.

    Source: §I · p. 1

  • Method

    The paper reconstructs trained classifiers, generates synthesizable RTL, validates implementations against a golden model, and characterizes FPGA and ASIC costs.

    Source: §I · p. 2, B. Model-to-Silicon Pipeline · p. 3, §VI · p. 8

  • Results

    At four HPCs, function-based classifiers have 7.9 times the median ASIC area of tree-based classifiers and 12.7 times that of rule-based classifiers, with median energy ratios of 3.2 and 5.1, respectively.

    Source: §VI · p. 8

  • Takeaways & Limitations

    A single 4-HPC J48 is recommended for the evaluated counter-constrained setting, with a 94.08% reference F1 and 95.9% recall.

    Source: §VI · p. 8

    ASIC and FPGA power and energy are estimates, and ASIC estimates may not represent fabricated-hardware consumption.

    Source: §V · pp. 7–8

Abstract

from arXiv · show

Hardware malware detectors (HMDs) classify programs as benign or malicious based on hardware performance counter (HPC) data. Previous studies have shown that ensemble classifiers outperform other classifiers on detection metrics. However, the area, power, and timing costs of HMDs remain open questions. We address these questions across a comprehensive design space comprising multiple classifier families, variable HPC sets, and ensemble learning methods. We designed a pipeline to reconstruct selected trained models, generate synthesizable register-transfer-level (RTL) implementations, validate each design against a bit-accurate golden model, and evaluate the implementations. The results show that tree- and rule-based detectors achieve the highest detection performance with nearly an order of magnitude less area and several times lower energy than function-based classifiers. Reducing the number of HPC inputs to fit a processor's concurrent-counter limit preserves detection performance while substantially reducing area, power, and delay.

I. INTRODUCTION

The introduction frames hardware malware detection as a response to software evasion, but notes that the hardware costs of detectors across a broad design space remain unmeasured. This study evaluates classifier configurations and their hardware costs to identify trade-offs relevant to processor counter limits.

I. INTRODUCTION

  • Hardware performance counters capture microarchitectural events, but processors limit how many can be read concurrently, constraining deployable detectors.Some Intel and AMD processors can read only four and six counters concurrently, respectively.Source: §I · p. 1
  • Prior comparisons found high detection performance for ensembles, but left their hardware costs unresolved.The study asks whether AdaBoost and bagging improve F1 enough to justify added area and energy at the same counter budget.Source: §I · p. 1
  • No prior study measured hardware costs across a comprehensive classifier design space on both FPGA and ASIC targets, despite area, power, and delay affecting processor integration.The section frames the open question as the power, performance, and area costs of HMDs.Source: §I · p. 1
  • The study evaluates 15 of 18 classifiers across 120 configurations, varying HPC counts and including AdaBoost and bagging ensembles.Its research questions compare classifier-family costs, counter-reduction trade-offs, and ensemble costs at fixed HPC budgets.Source: §I · p. 1
  • The authors build a model-to-silicon pipeline, characterize successful FPGA and completed ASIC implementations, relate F1 to hardware characteristics, and recommend a counter-limited configuration.The pipeline reconstructs selected trained models and generates synthesizable RTL.Source: §I · p. 2

A. Foundations of HPC-based malware detection.

Prior HMD work established that hardware-counter data can support malware detection, while leaving broad implementation-cost comparisons limited. Related work also motivates treating counter budgets and alternative detection channels as design considerations.

A. Foundations of HPC-based malware detection.

  • Demme et al. detected malware online from HPCs at roughly 90% accuracy, and later work studied sampling, processor integration, ensembles, and more complex detection targets,,,,,,,.The study in supplied the trained models evaluated for implementation cost.Source: A. Foundations of HPC-based malware… · p. 2

B. Implementation cost of HMD classifiers.

  • Earlier implementation-cost studies covered one integrated design point or small classifier sets, leaving conclusions potentially unrepresentative across a model design space spanning three orders of magnitude,,,,.The related-work passage reports a 4-HPC decision tree as the best trade-off among evaluated configurations.Source: B. Implementation cost of HMD… · p. 2

C. Granularity of the HPC budget.

  • The concurrent-counter limit makes HPC budget a design variable; system-call monitoring and custom counters are alternative approaches to that constraint,,.Source: C. Granularity of the HPC budget · p. 2

D. Alternative channels and narrowed targets.

  • HMDs observe processor execution, complementing software detectors that use file, ransomware, or network evidence,,,.Other work narrows HMD targets to malware such as ransomware or IoT settings.Source: D. Alternative channels and narrowed… · p. 2

E. Evasion, adversarial resilience, and faults.

The paper places implementation costs in the context of evasion and fault resilience, and evaluates a broad trained-classifier design space. Some classifier types are excluded because they cannot support the required hardware comparisons or implementation flows.

E. Evasion, adversarial resilience, and faults.

  • A fully parallel implementation of stochastic classifier switching requires additional resources, and area and leakage power generally increase with detector-pool size,.Shared logic and routing may prevent perfectly linear scaling.Source: E. Evasion, adversarial resilience,… · p. 2
  • The study evaluates detection and cost across a complete published classifier design space, validating RTL and characterizing FPGA and routed open-PDK ASIC implementations.Some designs cannot be routed with the limited metal layers of the SkyWater 130-nm process.Source: E. Evasion, adversarial resilience,… · p. 3

A. Experimental Setting and Detector Design Space

  • The evaluated models come from, whose dataset contains 3,700 benign and 3,700 malicious samples and uses a 70/30 train-test split.The 16 HPC events were reduced to nested sets of 8, 4, and 2 events.Source: A. Experimental Setting and Detector… · p. 3
  • The analysis covers 120 configurations of 15 classifiers across four families, omitting Random Forest, LMT, and KNN variants for implementation constraints.Random Forest variants could not complete the FPGA or ASIC flow; too few LMT variants were implementable for comparisons; KNN required infeasible on-chip training-set storage in the selected standard-cell flow.Source: A. Experimental Setting and Detector… · p. 3

B. Model-to-Silicon Pipeline

The pipeline reconstructs trained models, generates RTL, and compares implementations against reference behavior before hardware evaluation. It also documents validation differences, number-format choices, and simulation results.

B. Model-to-Silicon Pipeline

  • The five-stage pipeline reconstructs Weka models, builds classifier-specific representations and a golden model, generates registered-input/output Verilog, simulates it, and submits designs to FPGA and ASIC flows.The datapath classifies raw 32-bit counter values as benign or malicious.Source: B. Model-to-Silicon Pipeline · p. 3

C. Validation of the Experiments

  • Validation compared RTL with Weka over 7,400 instances, while detection metrics used Weka confusion matrices on a 2,220-instance test set.Five Hoeffding-tree implementations had 90.2–98.5% agreement and 24 bagging configurations had 99.6% median agreement; these RTL/Weka differences are distinct from RTL/golden-model mismatches.Source: C. Validation of the Experiments · p. 3

D. Number-Format Policy

  • Classifier-family operations determined numerical formats: tree and rule thresholds were mapped to integer input ranges, while function-based models used Weka normalization and compact weights selected against a 0.05-percentage-point accuracy tolerance.The weight-format search tested 8-, 12-, 16-, and 20-bit formats with wide accumulators on the 2,220-sample test set.Source: D. Number-Format Policy · pp. 3–4

E. RTL Simulation

  • RTL was simulated against golden-model predictions for all 7,400 cases across 120 designs, covering 888,000 design-input pairs with no mismatches.Agreement with Weka was tracked separately; quantized function-based implementations typically exceeded 99.9% agreement, with MLP sigmoid-lookup implementations at approximately 99.95%.Source: E. RTL Simulation · p. 4

F. FPGA and ASIC Flows

The FPGA and ASIC flows characterize designs with target-specific tools and resource metrics. FPGA implementation succeeded for 118 of 120 designs, while ASIC failures trigger a staged retry policy.

F. FPGA and ASIC Flows

  • 118 of 120 designs were implemented successfully on the FPGA; the 16-HPC MLP and 4-HPC bagged MLP exceeded available resources.The target was an Intel Cyclone V, processed with Quartus II 15.0 under a 10-ns clock constraint.Source: F. FPGA and ASIC Flows · p. 4
  • ASIC implementation uses SkyWater 130-nm cells and retries failed designs with progressively lower utilization and increased routing capacity.The retry policy expands core area across six utilization tiers; designs exhausting the policy are reported with their failing stage.Source: F. FPGA and ASIC Flows · p. 4
  • FPGA designs are assessed by ALMs, registers, DSP blocks, memory bits, maximum frequency, and dynamic power; ASIC designs by cell area, timing slack, and power.Timing is analyzed register to register, with inputs and the classification output assigned to virtual pins.Source: F. FPGA and ASIC Flows · p. 4
  • 251 ALMs for 4-HPC SGD versus 398 for J48 does not imply lower ASIC area: SGD uses 88,004 µm2 versus J48’s 12,731 µm2.FPGA resources and ASIC area are therefore presented separately rather than assuming identical rankings across targets.Source: F. FPGA and ASIC Flows · p. 4

IV. IMPLEMENTATION RESULTS

The implementation results combine reference-classifier detection metrics with FPGA and routed ASIC characterization. The setup uses a SkyWater open-PDK ASIC flow and a Cyclone V FPGA flow.

IV. IMPLEMENTATION RESULTS

  • Detection metrics come from Weka reference tests, while resource and timing metrics come from FPGA and ASIC flows; power and energy are flow-derived estimates.Results include only configurations completing all characterization stages, and documented implementation differences may prevent identical hardware predictions.Source: §IV · p. 4

A. Simulation Setup

  • The ASIC setup uses the SkyWater sky130hd library at 1.8 V and 25 °C, with switching activity extracted from gate-level simulations of routed netlists.OpenROAD-flow-scripts and Yosys 0.68 are used for logic synthesis.Source: A. Simulation Setup · p. 4
  • Table I covers power, performance, and area for every 4-HPC single-classifier design point.Its scope is limited to single classifiers using four hardware performance counters.Source: Table I · p. 5
  • The FPGA flow uses Quartus II 15.0, while the ASIC and FPGA flows run on machines with 32 and 16 GB of memory, respectively.The ASIC machines have 32 cores and 64 GiB of memory.Source: A. Simulation Setup · p. 5

B. Deployment Metrics

Tree- and rule-based single classifiers achieve substantially higher F1 scores than function-based classifiers with four HPCs. Ensembles improve some metrics, but their effects depend on classifier and metric.

B. Deployment Metrics

  • With four HPCs, single Random Tree, J48, REPTree, JRip, PART, and Decision Table classifiers reach about 92%–94% F1, versus 73%–76% for function-based classifiers.Recall falls to 62% in some function-based configurations, corresponding to about 38% of malicious samples classified as benign.Source: B. Deployment Metrics · p. 5
  • With four HPCs, the higher-F1 AdaBoost or bagging ensemble yields median recall and precision gains of 1.15 and 0.48 percentage points, respectively, and reduces false-positive rate by 0.36 points.For J48, AdaBoost raises F1 by about 1.7 points, mainly through a 3.2-point precision increase; recall remains about 96%.Source: B. Deployment Metrics · p. 5

C. Implementation Cost: Power, Performance, and Area

Implementation-cost comparisons show that FPGA and ASIC area rankings can diverge, while a four-counter J48 balances several costs. Higher-F1 alternatives may require substantially more area or more counters.

C. Implementation Cost: Power, Performance, and Area

  • 251 ALMs for 4-HPC SGD versus 398 for J48 contrasts with ASIC areas of 88,004 versus 12,731 µm2, while function-based designs can overlap tree and rule designs in FPGA ALMs.Dedicated FPGA DSP blocks can account for the overlap; the two targets support similar trade-off conclusions without identical family area rankings.Source: C. Implementation Cost: Power,… · p. 5
  • Among single classifiers using at most four HPCs, J48 has the highest reference recall and an F1 score close to the subset’s best, while Random Tree is 0.2 points higher in F1 but costs 2.1 times as much ASIC area and energy.J48’s recall is 95.9%; alternatives Decision Table, OneR, JRip, PART, and REPTree have 83.8%–93.4% recall and false-negative rates about 1.6–4.0 times higher.Source: C. Implementation Cost: Power,… · p. 6
  • All single-classifier configurations within one F1 percentage point of the maximum use at least eight HPCs; 8-HPC J48 has the lowest area in that group at 17,549 µm2.Four-HPC ensembles within the same F1 interval require about 9.4–11.3 times the ASIC area of single 4-HPC J48.Source: C. Implementation Cost: Power,… · p. 7
  • Pareto frontiers mark designs not surpassed across every metric in a comparison set, but missing ASIC energy results could change the frontier.Lower area and energy, and higher frequency, are preferred in their respective comparisons.Source: C. Implementation Cost: Power,… · p. 7
  • Tree- and rule-based classifiers dominate most reported comparisons, but SGD is an ASIC energy-frontier exception and uses about 22 times the estimated energy of the 4-HPC bagged Hoeffding Tree.SGD’s F1 is about 0.2 percentage points higher; the lower-energy tree and rule designs with ASIC estimates are Hoeffding Tree and Decision Stump.Source: C. Implementation Cost: Power,… · p. 7
  • Single classifiers generally lie on or near the strongest cost-performance frontiers, although some ensembles improve on their base classifiers; 16-HPC J48 has the highest F1 and about one-fifth the FPGA resources of the best ensembles.The boosted 4-HPC Hoeffding Tree is an exception among ensemble frontier points, with F1 close to 76%, below stronger tree and rule classifiers.Source: C. Implementation Cost: Power,… · p. 7
  • The 4-HPC J48 is recommended when ASIC area, energy, FPGA ALM usage, and maximum frequency all matter; it uses 12,731 µm2, an estimated 27.3 pJ per inference, and 398 ALMs.The 16-HPC Decision Table dominates J48 in unrestricted ASIC area and energy comparisons but requires four times as many input counters.Source: C. Implementation Cost: Power,… · pp. 5, 7

V. LIMITATIONS AND FUTURE WORK

Reported costs are specific to a fully parallel, register-controlled datapath and a fixed ASIC design without per-classifier optimization. Power and energy are estimates, and proposed future work targets switching activity, critical-path delay, and throughput.

V. LIMITATIONS AND FUTURE WORK

  • The fixed ASIC flow omits per-classifier optimization, so reported costs represent the selected architecture, tool settings, and technology level.The evaluated datapaths use fully parallel, register-controlled inputs and outputs.Source: §V · p. 7
  • ASIC estimates use uniform gate delays and shuffled samples, omitting routed interconnect effects and temporal correlations between successive counter readings.FPGA power and energy are also estimates; FPGA energy per inference uses dynamic power at the nominal 10-ns clock period.Source: §V · pp. 7–8
  • Future work could test clock gating, retiming-driven synthesis, and pipelining while accounting for added register area, power, and latency.Source: §V · p. 8

VI. CONCLUSIONS

Across the evaluated configurations, tree- and rule-based classifiers offer favorable detection-to-cost ratios, while reducing HPCs and using ensembles involve trade-offs. The study recommends a single 4-HPC J48 detector for the evaluated counter-constrained setting.

VI. CONCLUSIONS

  • At four HPCs, function-based models have 7.9 times the median ASIC area of trees and 12.7 times that of rules; median energy ratios are 3.2 and 5.1, respectively.Recall rates on some function-oriented configurations can be as low as 62%.Source: §VI · p. 8
  • Reducing J48 from 16 to 4 HPCs lowers area by 48.3% while F1 falls from 96.63% to 94.08%; reducing to 2 HPCs saves another 46.2% area but lowers F1 to 88.50%.Four counters are supported as a favorable J48 operating point within the evaluated configurations.Source: §VI · p. 8
  • With four HPCs, AdaBoost improves J48 F1 by approximately 1.7 percentage points; 4-HPC ensembles within one point of best F1 require 9.4 to 11.3 times J48’s ASIC area.The F1 gain is mainly due to increased precision and reduced false positive rates.Source: §VI · p. 8
  • The recommended single 4-HPC J48 uses 12,731 µm2 and an estimated 27.3 pJ per ASIC inference, occupies 398 FPGA ALMs, and achieves 94.08% reference F1.Its F1 is approximately 98% of the highest ensemble F1, and its 95.9% recall is highest among evaluated single classifiers using at most four HPCs.Source: §VI · p. 8

Related papers

Loading 2610.12795v1…