Hardware-based Malware Detectors (HMDs) have shown promise in detecting malicious workloads. However, the current HMDs focus solely on the CPU core of a System-on-Chip (SoC) and, therefore, do not exploit the full potential of the hardware telemetry. In this paper, we propose XMD, an HMD that uses an expansive set of telemetry channels extracted from the different subsystems of SoC. XMD exploits the thread-level profiling power of the CPU-core telemetry, and the global profiling power of non-core telemetry channels, to achieve significantly better detection performance than currently used Hardware Performance Counter (HPC) based detectors. We leverage the concept of manifold hypothesis to analytically prove the performance gains observed in XMD. We train and evaluate XMD using hardware telemetries collected from 904 benign applications and 1205 malware samples on a commodity Android Operating System (OS)-based mobile device. XMD improves over currently used HPC-based detectors by 32.91% for the in-distribution test data. XMD achieves the best detection performance of 86.54% with a false positive rate of 2.9%, compared to the detection rate of 80\%, offered by the best performing software-based Anti-Virus(AV) on VirusTotal, on the same set of malware samples.

翻译：基于硬件的恶意软件检测器在检测恶意负载方面展现出潜力。然而，当前HMD仅关注片上系统的CPU核心，未能充分利用硬件遥测的全部潜力。本文提出XMD，一种从SoC不同子系统提取广泛遥测通道的HMD。XMD利用CPU核心遥测的线程级剖析能力与非核心遥测通道的全局剖析能力，其检测性能显著优于当前基于硬件性能计数器的检测器。我们利用流形假设概念，从分析角度证明了XMD的性能提升。基于从商用Android操作系统移动设备上收集的904个良性应用与1205个恶意软件样本的硬件遥测数据，我们对XMD进行训练与评估。在分布内测试数据上，XMD较当前使用的HPC检测器性能提升32.91%。XMD达到86.54%的最佳检测性能（假阳性率为2.9%），而VirusTotal上性能最佳的基于软件的防病毒软件对同一恶意软件样本集的检测率为80%。