Using Performance Counters in Malware Detection: Data Analysis and Anomaly

This research aims to study the use of performance counters for malware detection by monitoring the usage of system resources. Operating systems provide performance counters to track system and application performance metrics, which include CPU utilization, memory consumption, disk traffic, and network communication metrics. The abnormal utilization patterns of malware through crypto mining software create detectable signatures in performance counters. A research analysis uses randomly created file information containing file details about their name length, measurement, and type to determine if they match one of the three classifications: malware files, unknown viruses, or clean files. Using the collected data, researchers were able to identify malware patterns through specific features, which produced visual representations of the results. Performance counters demonstrate limited effectiveness in virus detection, but researchers stressed how a combination with other detection methods, such as antivirus and intrusion detection systems, provides optimal defense solutions.