I’ve recently completed a performance validation for a behavioral malware detection kernel (Planck-99) designed for MCU-class devices.
The core challenge was achieving reliable classification on hardware with no FPU and extreme memory constraints, which effectively rules out traditional heavy NPU/TFLite stacks. Instead of a neural network, I opted for a pruned decision-tree ensemble compiled into a 27KB header-only C kernel.
Key results:
- Latency: 34ns median inference.
- Footprint: 27KB binary / 1.4MB peak RAM.
- Generalization: 96.28% accuracy on unseen IoT traces, with length-invariance confirmed up to 51x the training ceiling (ADFA-LD).
I’m interested in the community's perspective on the trade-offs between NPU-based inference and deterministic, if-else-based classification for security-critical tasks. Does the deterministic nature of decision trees offer a significant advantage for security audits compared to opaque neural models in your current workflows?
I’ve attached the technical brief for reference and would appreciate any feedback on the feature-projection mechanics.
https://github.com/Division-36/Planck-9 ... lBrief.pdf