Real-Time Multi-Modal Subcomponent-Level Measurements for Trustworthy System Monitoring and Malware Detection

TL;DR

This work tackles the risk of untrustworthy processor-based readings during advanced cyberattacks by proposing a subcomponent-level, real-time, multi-modal telemetry framework that collects synchronized measurements from NIC, GPU, keyboard, and CPU HPC/power. It details an integrated testbed and firmware-level NIC enhancements, GPU call-graph reconstruction, keyboard timing metrics, and CPU-power/HPC monitoring, all aimed at robust anomaly detection even when the main processor is compromised. The study demonstrates a VM-based malware data collection pipeline and evaluates anomaly detection across subcomponents, showing that NIC and HPC measurements often provide the earliest signals and that fusing modalities yields more reliable detection across diverse attack sequences. The approach advances trustworthy system monitoring with practical pathways for malware detection that remain effective under late-stage compromises, complemented by a SHIELD SATA/NBD filesystem-aware framework in the appendix for deeper storage-layer insights.

Abstract

With increasingly sophisticated cyber-adversaries able to access a wider repertoire of mechanisms to implant malware such as ransomware, CPU/GPU keyloggers, and stealthy kernel rootkits, there is an urgent need for techniques to detect and mitigate such attacks. While state of the art relies on digital and analog side channel measurements assuming trustworthiness of measurements obtained on the main processor, such an approach has limitations since processor-based side channel measurements are potentially untrustworthy. Sophisticated adversaries (especially in late stage cyber attacks when they have breached the computer and network security systems such as firewalls and antivirus and penetrated the computer's OS) can compromise user-space and kernel-space measurements. To address this key limitation of state of the art, we propose a "subcomponent-level" approach to collect side channel measurements so as to enable robust anomaly detection in a modern computer even when the main processor is compromised. Our proposed approach leverages the fact that modern computers are complex systems with multiple interacting subcomponents and measurements from subcomponents can be used to detect anomalies even when the main processor is no longer trustworthy. We develop mechanisms to obtain time series measurements of activity of several subcomponents and methodologies to process and fuse these measurements for anomaly detection. The subcomponents include network interface controller, GPU, CPU Hardware Performance Counters, CPU power, and keyboard. Our main hypothesis is that subcomponent measurements can enable detection of security threats without requiring a trustworthy main processor. By enabling real-time measurements from multiple subcomponents, the goal is to provide a deeper visibility into system operation, thereby yielding a powerful tool to track system operation and detect anomalies.

Figures (29)

• Figure 1: Integrated testbed for collection of subcomponent measurement datasets.
• Figure 2: Integrated testbed for subcomponent measurements with Mandiant FakeNet-NG used to emulate connectivity from the testbed machine.
• Figure 3: Settings for time intervals for malware run and data collection on integrated testbed.
• Figure 4: Netronome Agilio CX single-port (left) and dual-port (right) SmartNICs used in this project for experimental prototype testing of enabling measurements from custom firmware-level modifications on NICs.
• Figure 5: Measurements of TCP and UDP packet counts and byte counts (transmitted, received) for different ports collected using modified firmware under different patterns of network traffic. Left: with sampling rate of 10ms; Middle: with sampling rate of 100ms; Right: Programming model for integration of firmware modifications in the CoreNIC structure to enable custom datapath with parsing, matching, and action functions.