  Hardware-based malware detectors (HMDs) are a key emerging technology to
build trustworthy computing platforms, especially mobile platforms. Quantifying
the efficacy of HMDs against malicious adversaries is thus an important
problem. The challenge lies in that real-world malware typically adapts to
defenses, evades being run in experimental settings, and hides behind benign
applications. Thus, realizing the potential of HMDs as a line of defense - that
has a small and battery-efficient code base - requires a rigorous foundation
for evaluating HMDs.
  To this end, we introduce EMMA - a platform to evaluate the efficacy of HMDs
for mobile platforms. EMMA deconstructs malware into atomic, orthogonal actions
and introduces a systematic way of pitting different HMDs against a diverse
subset of malware hidden inside benign applications. EMMA drives both malware
and benign programs with real user-inputs to yield an HMD's effective operating
range - i.e., the malware actions a particular HMD is capable of detecting. We
show that small atomic actions, such as stealing a Contact or SMS, have
surprisingly large hardware footprints, and use this insight to design HMD
algorithms that are less intrusive than prior work and yet perform 24.7%
better. Finally, EMMA brings up a surprising new result - obfuscation
techniques used by malware to evade static analyses makes them more detectable
using HMDs.
