Malicious Firmware Detection with Hardware Performance Counters

Xueyang Wang, Charalambos Konstantinou, Michail Maniatakos, Ramesh Karri, Serena Lee, Patricia Robison, Paul Stergiou, Steve Kim

Research output: Contribution to journalArticlepeer-review

42 Scopus citations


Critical infrastructure components nowadays use microprocessor-based embedded control systems. It is often infeasible, however, to employ the same level of security measures used in general purpose computing systems, due to the stringent performance and resource constraints of embedded control systems. Furthermore, as software sits atop and relies on the firmware for proper operation, software-level techniques cannot detect malicious behavior of the firmware. In this work, we propose ConFirm, a low-cost technique to detect malicious modifications in the firmware of embedded control systems by measuring the number of low-level hardware events that occur during the execution of the firmware. In order to count these events, ConFirm leverages the Hardware Performance Counters (HPCs), which readily exist in many embedded processors. We propose a comparison-based technique to detect malicious modifications in firmwares with simple control-flows. For firmwares with more complex control-flows, we use machine learning techniques to automatically extract the relations among different hardware events. This method significantly reduces the number of pre-stored valid HPC signatures without compromising the detection accuracy. Finally, we reduce the consumption of local resources by implementing a remote-based detection mechanism. We evaluate the detection capability and performance overhead of the proposed technique on various types of firmware running on ARM- and PowerPC-based embedded processors. Experimental results demonstrate its practicality and effectiveness.
Original languageEnglish (US)
Pages (from-to)160-173
Number of pages14
JournalIEEE Transactions on Multi-Scale Computing Systems
Issue number3
StatePublished - Jul 1 2016
Externally publishedYes

Bibliographical note

Generated from Scopus record by KAUST IRTS on 2022-09-13

ASJC Scopus subject areas

  • Information Systems
  • Control and Systems Engineering
  • Hardware and Architecture


Dive into the research topics of 'Malicious Firmware Detection with Hardware Performance Counters'. Together they form a unique fingerprint.

Cite this