HardCore: Detalhando um HIDS por Assinatura em Hardware

Most Host Intrusion Detection Systems (HIDS) do not count withmemory evaluation capabilities, being that the reason why theyare not able to detect Advanced Volatile Threats, such as FilelessMalware, which can only be detected via memory scans. In thiswork, we propose HardCore, a signature based HIDS in hardware,able to perform signature matching with no overhead to the endpointsystem. HardCore receives as input, at every memory write, acache line, outputting any matches against known fileless malwarepresent in the signature base. HardCore uses bloom filters and malwareclustering to operate, having its signature matrices divided toobtain the gains originating from those implementation choices.