Detection of anomalous program execution using hardware-based micro-architectural data

Patent metadata

Field	Value
Publication number	US-10025929-B2
Application number	US-201314778007-A
Country	US
Kind code	B2
Filing date	Nov 5, 2013
Priority date	Mar 18, 2013
Publication date	Jul 17, 2018
Grant date	Jul 17, 2018

Abstract

Disclosed are devices, systems, apparatus, methods, products, media and other implementations, including a method that includes obtaining hardware-based micro-architectural data, including hardware-based micro-architectural counter data, for a hardware device executing one or more processes, and determining based, at least in part, on the hardware-based micro-architectural data whether at least one of the one or more processes executing on the hardware device corresponds to a malicious process. In some embodiments, determining based on the hardware-based micro-architectural data whether the at least one of the one or more processes corresponds to a malicious process may include applying one or more machine-learning procedures to the hardware-based micro-architectural data to determine whether the at least one of the one or more processes corresponds to the malicious process.

First claim

What is claimed is:

1. A method for detection of anomalous program execution using hardware-based micro-architectural data using performance counters internal to one or more processors and configured to count internal events of the one or more processors, the method comprising:
obtaining hardware-based micro-architectural data, including hardware-based time-varying micro-architectural performance counter data, for a hardware device executing one or more processes, wherein the time-varying micro-architectural performance counter data measures instruction-level events that occur on one or more circuits of the hardware device, wherein the events are internal to the one or more processors executing said processes, the events are counted on performance counters of said one or more processors, and the performance counters are configured to count said events;
applying one or more machine-learning procedures to the obtained hardware-based micro-architectural data of the hardware device to determine whether at least one of the one or more processes executing on the hardware device corresponds to an anomalous process, wherein applying one or more machine-learning procedures comprises classifying the obtained hardware-based time-varying micro-architectural performance counter data based on previously identified patterns of hardware-based micro-architectural data associated with one or more anomalous processes;
determining that the at least one of the one or more processes corresponds to an anomalous process based on the applied one or more machine-learning procedures; and
terminating the execution of the at least one of the one or more processes determined to correspond to an anomalous process.

2. The method of claim 1 , wherein obtaining the hardware-based micro-architectural data comprises:
obtaining the hardware-based micro-architectural data at various time instances.

3. The method of claim 2 , wherein obtaining the hardware-based micro-architectural data at the various time instances comprises:
performing one or more of a data push operation initiated by the hardware device to send the hardware-based micro-architectural data, or a data pull operation, initiated by an antivirus engine, to send the hardware-based micro-architectural data.

4. The method of claim 1 , wherein obtaining the hardware-based micro-architectural data comprises:
obtaining multi-core hardware-based micro-architectural data resulting from execution of the one or more processes on a processor device with multiple processor cores; and
correlating the respective hardware-based micro-architectural data obtained from each of the multiple processor cores to the one or more processes.

5. The method of claim 1 , wherein applying the one or more machine-learning procedures to the hardware-based micro-architectural data to determine whether the at least one of the one or more processes corresponds to the anomalous process comprises:
matching the obtained hardware-based time-varying micro-architectural performance counter data to the previously identified patterns of hardware-based micro-architectural data associated with one or more anomalous processes.

6. The method of claim 5 , further comprising:
obtaining updates for one or more patterns of hardware-based micro-architectural data associated with the one or more anomalous processes.

7. The method of claim 6 , wherein obtaining the updates comprises:
downloading encrypted data for previously identified patterns of hardware-based micro-architectural data associated with the one or more anomalous processes to an antivirus engine in communication with the hardware device providing the hardware-based micro-architectural data;
decrypting at the antivirus engine the downloaded encrypted data for the previously identified patterns of hardware-based micro-architectural data associated with the one or more anomalous processes; and
updating a revision counter maintained by the antivirus engine indicating a revision number of a most recent update of the previously identified patterns of hardware-based micro-architectural data.

8. The method of claim 1 , wherein the one or more machine learning procedures comprise one or more of: a k-nearest neighbor procedure, a decision tree procedure, a random forest procedure, an artificial neural network procedure, a tensor density procedure, a hidden Markov model procedure, or a Support Vector Machine (SVM).

9. The method of claim 1 , wherein the at least one of the one or more processes that corresponds to the anomalous process comprises one or more of a non-malicious, or a malicious process, the malicious process including one or more of: a malware process, or a side-channel attack process.

10. The method of claim 1 , wherein the hardware-based micro-architectural data comprise one or more of: processor load density data, branch prediction performance data, or data regarding instruction cache misses.

11. A system for detection of anomalous program execution using hardware-based micro-architectural data using performance counters of one or more processors and configured to count internal events of the one or more processors, the one or more processors including performance counters configurable to count events internal to said one or more processors, the system comprising:
a hardware device executing one or more processes, including the one or more processors; and
an antivirus engine in communication with the hardware device, the antivirus engine configured to:
obtain hardware-based micro-architectural data, including hardware-based time-varying micro-architectural performance counter data, for the hardware device executing the one or more processes, wherein the time-varying micro-architectural performance counter data measures instruction-level events that occur on one or more circuits of the hardware device, wherein the events are internal to the one or more processors executing said processes, the events are counted on the performance counters of said one or more processors, and the performance counters are configured to count said events;
apply one or more machine-learning procedures to the obtained hardware-based micro-architectural data of the hardware device to determine whether at least one of the one or more processes executing on the hardware device corresponds to an anomalous process, wherein applying one or more machine-learning procedures comprises classifying the obtained hardware-based time-varying micro-architectural performance counter data based on previously identified patterns of hardware-based micro-architectural data associated with one or more anomalous processes;
determine that the at least one of the one or more processes corresponds to an anomalous process based on the applied one or more machine-learning procedures; and
terminate the execution of the at least one of the one or more processes determined to correspond to an anomalous process.

12. The system of claim 11 , wherein the antivirus engine configured to obtain the hardware-based micro-architectural data is configured to:
obtain the hardware-based micro-architectural data at various time instances.

13. The system of claim 12 , wherein the antivirus engine configured to obtain the hardware-based micro-architectural data at the various time instances is configured to:
receive the hardware-based micro-architectural data in response to one or more of: a data push operation initiated by the hardware device, or a data pull operation initiated by the antivirus engine.

14. The system of claim 11 , wherein the antivirus engine configured to apply the one or more machine-learning procedures to the hardware-

Assignees

• Univ Columbia
• Sethumadhavan Lakshminarasimhan
• Demme John
• Schmitz Jared
• Tang Adrian
• Stolfo Sal
• Maycock Matthew

Inventors

• Sethumadhavan Lakshminarasimhan
• Demme John
• Schmitz Jared
• Tang Adrian
• Stolfo Sal
• Maycock Matthew

Classifications

• G06F11/3466

  Performance evaluation by tracing or monitoring · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• G06F2201/88

  Monitoring involving counting · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title