LAPD: Lifecycle-Aware Power-Based Malware Detection

Behavioral malware detectors that analyze power traces have proven to be a promising defense to secure lowcomplexity embedded systems. However, recent work shows that this approach struggles in more challenging contexts with multicore processors, multithreaded software, and inherently stealthy or deliberately evasive attacks. These detectors consider the execution of an attack to be a single detection event, whereas realworld malware requires a lifecycle of sequential stages to prime an attack, execute, and perform post-exploit actions. In this work, we augment traditional detectors with a lifecycle-aware backend to collate detection events, generate more informed detection decisions, and thus significantly improve detection performance. Our lifecycle-aware detector is implemented via a hidden Markov model trained on general attack lifecycles. Leveraging signals across lifecycle stages, this approach enables detection of attacks even if certain stages are missed by a traditional detector. We evaluate this framework on an 8-core embedded-class Intel Xeon platform running drone-based workloads, using boardlevel power measurements. When tested against attack lifecycles derived from the MITRE ATT&CK matrix, our lifecycle-aware detector is able to achieve an ROC-AUC score of 0.98 on baseline attack lifecycles. Furthermore, it achieves a score of 0.70 on attack lifecycle specifications that a baseline densitybased detector completely fails to detect, due to it's vulnerability to simple attack stalling strategies.