Breaking the Encryption Barrier: Early Detection of Malware Using Hardware-Aware Models

Malware, considered as software deliberately created to cause harm on computers, networks, or data, is one of the most substantial and persistent dangers that affect modern computing systems. The rapid rise in internet usage, digital infrastructure, and networked devices have increased the risk of malware attacks requiring the development of more advanced and effective detection systems.Standard software-based malware detection solutions, like antivirus applications, predominantly utilize signature-based approaches that match file byte sequences against established malware signatures. However useful to some degree, these approaches encounter difficulties with innovative and polymorphic malware, which may skirt detection by perpetually altering their signatures. Moreover, software-only detection methods frequently demand substantial resources, resulting in heightened computational burden and diminished performance.

Ransomware threatens modern computing infrastructure, causing substantial economic and operational disruption across industries. These attacks leverage sophisticated evasion techniques and rapid file encryption to cripple systems before conventional security mechanisms can respond. According to Internet Crime Complaint Center (IC3) reports, there were 2825 ransomware complaints with losses of more than USD 59.6M in 2023 and the trend is expected to worsen. Existing detection solutions, particularly signature-based and behavior-driven approaches, often fail to offer the speed and adaptability required to contain emerging variants in real-time. The damage caused to an organization by ransomware incidents can be divided into internal damage to restart the organization, external damage, and reputational damage.

The project focuses on detecting malware at an early stage by monitoring low-level hardware behaviour through Hardware Performance Counters (HPCs). The project analyses microarchitectural events such as cache misses, branch behaviour, instruction activity, and memory accesses using machine-learning models. Its objective is to identify malicious activity before significant encryption or system damage occurs, enabling fast, lightweight, and hardware-assisted malware detection.

Funding Agency:

Inclusivity Research Grant (IRG) by Anusandhan National Research Foundation (ANRF)

Total Project Cost: 38,03,040/-

Project Duration: 36 months

Principal Investigator: Dr. Sheel Sindhu Manohar