Malware Detection in Embedded Devices using Artificial Hardware Immunity

Abstract With the rapid proliferation of IoT devices and its growing usage in safety-critical systems, securing these devices from malicious attacks has become increasingly challenging. Due to the resource-constrained nature of IoT devices, real-time software-based malware detection is difficult or infeasible. Alternatively, a promising approach is utilizing hardware malware detection techniques. In this paper, we introduce a novel Hardware Immune System (HWIS), a stand-alone, hardware-supported malware detection approach for microprocessors that leverages Artificial Immune Systems for detecting botnet activity. This technique is suitable for low-power, resource constrained and network facing embedded devices. The proposed model is capable of detecting botnet behavior with an accuracy of 96.7%, false negative rate of 6.5%, and F1-score of 0.96. We implemented and simulated the proposed architecture using 32nm low power PTM SPICE models and the Synopsys 32nm EDK and found the power and area overhead to be 2.57% and 5.25%, respectively, with no impact on delay, using a 28nm RISC-V CPU as a baseline.