Anomaly detection in real-time multi-threaded processes on embedded systems and devices using hardware performance counters and/or stack traces

Patent metadata

Field	Value
Publication number	US-12450353-B2
Application number	US-202318225080-A
Country	US
Kind code	B2
Filing date	Jul 21, 2023
Priority date	May 4, 2018
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

An aspect of behavior of an embedded system may be determined by (a) determining a baseline behavior of the embedded system from a sequence of patterns in real-time digital measurements extracted from the embedded system; (b) extracting, while the embedded system is operating, real-time digital measurements from the embedded system; (c) extracting features from the real-time digital measurements extracted from the embedded system while the embedded system was operating; and (d) determining the aspect of the behavior of the embedded system by analyzing the extracted features with respect to features of the baseline behavior determined.

First claim

What is claimed is:

1. A computer-implemented method for determining an aspect of behavior of an embedded system, the computer-implemented method comprising:
a) determining a baseline behavior of the embedded system from a sequence of patterns in real-time digital measurements extracted from each of at least two of multiple process threads of the embedded system;
b) extracting, while the embedded system is operating, real-time digital measurements from each of the at least two of multiple process threads of the embedded system;
c) extracting features from the real-time digital measurements extracted from each of the at least two of multiple process threads of the embedded system while the embedded system was operating; and
d) determining the aspect of the behavior of the embedded system by analyzing temporal relationships between the extracted features of different ones of the multiple process threads with respect to temporal relationships between features extracted from the real-time digital measurements, extracted from different ones of the multiple process threads, from which the baseline behavior was determined.

2. The computer-implemented method of claim 1 wherein the aspect of behavior determined is whether the embedded system is functioning as desired.

3. The computer-implemented method of claim 1 wherein the aspect of behavior determined is whether code in the embedded system has been subject to an unauthorized modification.

4. The computer-implemented method of claim 1 wherein the embedded system consists of at least one embedded device.

5. The computer-implemented method of claim 1 wherein the embedded system includes at least one embedded device and at least one peripheral device.

6. The computer-implemented method of claim 5 wherein the at least one peripheral device is selected from a group of devices consisting of (a) sensors, (b) actuators, (c) displays, and (d) storage devices.

7. The computer-implemented method of claim 1 wherein determining the aspect of the behavior of the embedded system uses at least one of a trained machine learning classifier and statistical analysis.

8. The computer-implemented method of claim 1 wherein the embedded system includes at least one of a general purpose computer, an embedded microprocessor, or a specialized machine running code.

9. The computer-implemented method of claim 1 wherein the real-time digital measurements are extracted from each of the at least two of multiple process threads of the embedded system via at least one hardware performance counter on the embedded system.

10. The computer-implemented method of claim 1 wherein the real-time digital measurements are extracted from each of the at least two of multiple process threads of the embedded system via at least one stack trace on the embedded system.

11. Apparatus for determining an aspect of behavior of an embedded system, the apparatus comprising:
a) a baseline determination module configured to determine a baseline behavior of the embedded system from a sequence of patterns in real-time digital measurements extracted from each of at least two of multiple process threads of the embedded system;
b) a measurement module configured to extract, while the embedded system is operating, real-time digital measurements from each of the at least two of multiple process threads of the embedded system;
c) a feature extraction module for extracting features from the real-time digital measurements extracted from each of the at least two of multiple process threads of the embedded system while the embedded system was operating; and
d) an analyzer adapted to determine the aspect of the behavior of the embedded system by analyzing temporal relationships between the extracted features of different ones of the multiple process threads with respect to temporal relationships between features extracted from the real-time digital measurements, extracted from different ones of the multiple process threads, from which the baseline behavior was determined.

12. The apparatus of claim 11 wherein the aspect of behavior determined is whether the embedded system is functioning as desired.

13. The apparatus of claim 11 wherein the aspect of behavior determined is whether code in the embedded system has been subject to an unauthorized modification.

14. The apparatus of claim 11 wherein the embedded system consists of at least one embedded device.

15. The apparatus of claim 11 wherein the embedded system includes at least one embedded device and at least one peripheral device, and wherein the at least one peripheral device is selected from a group of devices consisting of (a) sensors, (b) actuators, (c) displays, and (d) storage devices.

16. The apparatus of claim 11 wherein the analyzer is least one of a trained machine learning classifier and a statistical analyzer.

17. The apparatus of claim 11 wherein the embedded system includes at least one of a general purpose computer, an embedded microprocessor, or a specialized machine running code.

18. The apparatus of claim 11 wherein the baseline determination module and the measurement module each extract real-time digital measurements from each of the at least two of multiple process threads of the embedded system via at least one hardware performance counter on the embedded system.

19. The apparatus of claim 11 wherein the baseline determination module and the measurement module each extract real-time digital measurements from each of the at least two of multiple process threads of the embedded system via at least one stack trace on the embedded system.

20. A non-transitory computer-readable storage medium storing processor executable code which, when executed by at least one processor, cause the at least one processor to perform a method for determining an aspect of behavior of an embedded system, the method comprising:
a) determining a baseline behavior of the embedded system from a sequence of patterns in real-time digital measurements extracted from each of at least two of multiple process threads of the embedded system;
b) extracting, while the embedded system is operating, real-time digital measurements from each of the at least two of multiple process threads of the embedded system;
c) extracting features from the real-time digital measurements extracted from each of the at least two of multiple process threads of the embedded system while the embedded system was operating; and
d) determining the aspect of the behavior of the embedded system by analyzing temporal relationships between the extracted features of different ones of the multiple process threads with respect to temporal relationships between features extracted from the real-time digital measurements, extracted from different ones of the multiple process threads, from which the baseline behavior was determined.

Assignees

• Univ New York

Inventors

• Khorrami Farshad
• Karri Ramesh
• Krishnamurthy Prashanth

Classifications

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• G06F11/3419

  by assessing time · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F2221/2129

  Authenticate client device independently of the user · CPC title

• G06F11/0721

  within a central processing unit [CPU] · CPC title