LightBench Shines a Light on Hidden Threats
LightBench uses AI to analyze low-level hardware access events to detect novel malware before it is even known to exist.
Between a steady stream of news articles about data breaches and cheesy training sessions in the workplace, we have all had the threat of malware drummed into us from every angle. And rightly so — in the digital world we find ourselves in, one little slip can lead to a major corporate meltdown or months of hassles over the fallout from a stolen identity. But try as we might to stay ahead of malicious hackers, there is no winning this cat-and-mouse game.
The static analyses of binaries and signature-based detection methods that power traditional malware detection software packages are always at risk of falling behind the curve, leaving their users exposed. Many security professionals are also concerned that the rise of artificial intelligence (AI) could make malware even more difficult to detect in the future. The pace of change is also likely to accelerate, leaving normal protection mechanisms in the dust.
A group led by researchers at the University of California, Davis sees the potential of AI in a different light. They have developed a system called LightBench that leverages AI not to create malware, but to detect it. It does this in a way that is robust and efficient, and that could help us to stay on top of threats, even if they are as of yet unknown.
LightBench is a software-based, hardware-aware trusted execution platform that brings intelligent malware detection to the edge — that is, to small and often underpowered devices like those found in smart homes, factories, and healthcare settings. The system integrates machine learning with Hardware-assisted Malware Detection techniques, which use low-level data from Hardware Performance Counters (HPCs) to monitor the behavior of running programs.
HPCs capture hardware-level events such as memory accesses, cache hits and misses, or instruction counts. These events offer a deep look at what software is actually doing. By analyzing this data with trained machine learning models, LightBench can identify subtle behavioral patterns that may indicate the presence of malware, even if the code has been heavily obfuscated or is completely novel.
LightBench does not have to hog resources to make this possible. The team developed and tested the system on TinyML-compatible hardware, which is designed to run machine learning models with limited memory and power. They tested a variety of ML models both in Python and in converted C/C++ implementations using tools like m2cgen and ONNX Runtime, ensuring that the models could run efficiently on embedded platforms.
The initial results were promising. LightBench achieved accurate, low-latency malware detection with minimal resource use, opening the door to always-on, on-device cybersecurity for the vast and growing ecosystem of IoT devices. While malware continues to evolve, systems like LightBench offer a new path forward that could help us to stay ahead of the latest attack vectors.