  This paper presents an experimental design and data analytics approach aimed
at power-based malware detection on general-purpose computers. Leveraging the
fact that malware executions must consume power, we explore the postulate that
malware can be accurately detected via power data analytics. Our experimental
design and implementation allow for programmatic collection of CPU power
profiles for fixed tasks during uninfected and infected states using five
different rootkits. To characterize the power consumption profiles, we use both
simple statistical and novel, sophisticated features. We test a one-class
anomaly detection ensemble (that baselines non-infected power profiles) and
several kernel-based SVM classifiers (that train on both uninfected and
infected profiles) in detecting previously unseen malware and clean profiles.
The anomaly detection system exhibits perfect detection when using all features
and tasks, with smaller false detection rate than the supervised classifiers.
The primary contribution is the proof of concept that baselining power of fixed
tasks can provide accurate detection of rootkits. Moreover, our treatment
presents engineering hurdles needed for experimentation and allows analysis of
each statistical feature individually. This work appears to be the first step
towards a viable power-based detection capability for general-purpose
computers, and presents next steps toward this goal.
