How Can CPU Telemetry Detect Hidden Malware?

TL;DR

CPU telemetry can expose malicious computation because every attack must eventually execute instructions on a processor, regardless of its packaging or runtime container. By selecting relevant performance-monitoring events, processing them into features, and applying a trained machine-learning classifier, defenders can identify telemetry signatures associated with malware such as cryptocurrency miners across standalone processes, browsers, and virtual machines.

Transcript

Hello, everybody. Welcome, and thanks for joining us today. I'm Rahul Ghosh. I'm a security architect and a software engineer at Intel Corporation, and this is my co-presenter. Hi, I'm Zheng Zhang. I'm the principal engineer at Intel. So today, we are going to report our, our research on how to use hardware telemetry and machine learning techniques... Read More

Key Insights

• The CPU is a narrow execution point for attacks because malicious logic must eventually run as processor instructions on the victim machine, even when attackers change the malware's packaging, delivery method, or surrounding software environment.
• CPU telemetry consists of signals produced while instructions execute, including cache misses, branch mispredictions, retired-instruction counts, last branch records, and Intel Process Trace information originally designed to support performance optimization and debugging.
• Machine learning can convert fine-grained, noisy processor measurements into higher-level detection signals by processing selected performance-monitoring records into features and using those features in a malware classification pipeline.
• A malware telemetry signature is the distinctive way its execution affects relevant performance-monitoring events compared with benign workloads running on the same platform, and correlating more relevant events can make the signature more distinct.
• Relevant performance events can differ between malware classes, so building a detector begins by identifying the set of events that most clearly profiles the specific malicious computation being targeted.
• Runtime detection is a classification problem in which telemetry collected from an executing process is compared through a trained model with a previously characterized signature for the targeted malware behavior.
• CPU-based detection can identify equivalent malicious computation across deployment forms because the demonstrated cryptocurrency proof-of-work behavior remained observable in a standalone executable, JavaScript running in browsers, and a process inside a virtual machine.
• Virtual-machine detection requires additional noise handling because the host operating system cannot directly observe the guest's mining process, yet it can observe the VM process and detect the mining signature after filtering activity from other VM services and processes.

Questions & Answers

Q: How can CPU telemetry detect hidden malware?

CPU telemetry can detect hidden malware by measuring how executed instructions affect selected microarchitecture events. Investigators identify performance-monitoring events that distinguish a malware class from benign workloads, process those records into machine-learning features, and apply a trained classifier. Because malicious logic must execute on the CPU, its behavioral signature can remain visible even when the code is packaged, obfuscated, fileless, browser-based, or virtualized.

Q: What types of signals are included in CPU telemetry?

CPU telemetry includes microarchitecture events such as cache misses, branch mispredictions, and the number of retiring instructions. It can also include branch trace information from sources such as last branch records and Intel Process Trace. These signals were designed for performance optimization and debugging, but they also reveal how programs behave at the microarchitecture level while their instructions execute.

Q: Why is CPU telemetry useful for malware detection?

CPU telemetry is useful because every attack ultimately needs to execute its logic on the victim machine's processor. Attackers can change file formats, packing, obfuscation, delivery mechanisms, browsers, or virtualized containers, but they cannot avoid instruction execution while accomplishing their goal. Processor-level signals therefore provide a common observation point that may expose characteristic malicious computation across multiple deployment forms.

Q: What is a malware telemetry signature?

A malware telemetry signature is the distinctive effect that a malware workload has on performance-monitoring events while it executes. The signature separates that workload from benign programs running on the same platform. Investigators seek relevant events for each malware class, then correlate several events where possible, because a larger useful set can create a more distinct profile for runtime classification.

Q: How does machine learning use CPU performance events?

Machine learning uses CPU performance events through a pipeline that first selects events relevant to the targeted malware class. The system reads telemetry records from those events, processes the records to derive suitable features, and supplies the features to a classifier. The classifier operates with a model trained on representative execution data and determines whether current telemetry matches the targeted computation's known signature.

Q: Can CPU telemetry detect cryptocurrency mining in browsers?

CPU telemetry detected browser-based cryptocurrency mining in the demonstration because the JavaScript implementations performed the same proof-of-work computation as the targeted miner. When the code ran in Chrome, the system identified Chrome and pointed to the relevant tab. When it ran in Edge under a different sandboxing model, the classifier similarly detected Edge as the mining process.

Q: Can CPU telemetry detect malware running inside a virtual machine?

CPU telemetry can expose targeted computation inside a virtual machine, as shown by the Windows 10 VM demonstration. The host operating system lacked direct visibility into the guest's mining process, but it could monitor the VM process. After processing the records and filtering noise created by the VM's other services and processes, the detector identified the VM process as performing mining activity.

Q: What challenges arise when detecting malware with CPU telemetry?

The main challenge is that CPU telemetry is extremely fine-grained and noisy. It measures instruction-level or sub-instruction behavior, while a modern application may execute billions of instructions per second. Detection therefore requires selecting events that are relevant to the targeted malware, deriving useful features from large volumes of measurements, correlating multiple signals, and filtering unrelated activity, especially in complex environments such as virtual machines.

Summary & Key Takeaways

• Malware detection evolved from static signatures and heuristics to unpacking, memory scanning, emulation, cloud classification, behavioral analysis, and AI-based methods. This progression responded to packing, obfuscation, polymorphism, ransomware, cryptocurrency-mining malware, scripts, and fileless attacks, while the continuing security contest creates demand for signals that attackers cannot easily avoid.

• CPU telemetry includes microarchitecture events such as cache misses, branch mispredictions, and retired-instruction counts, along with branch information from last branch records or Intel Process Trace. Although originally intended for optimization and debugging, these signals can describe program behavior at a low level and help infer the intent of unknown software.

• The demonstrated detection pipeline first identifies performance-monitoring events relevant to a malware class, processes collected telemetry into machine-learning features, and applies a trained classifier. A cryptocurrency miner was detected as a command-line process, inside Chrome and Edge tabs, and within a Windows 10 virtual machine despite added noise and limited host visibility.