Ransomware detection using I/O patterns
US-10078459-B1 · Sep 18, 2018 · US
US2018239686A1 · US · A1
| Field | Value |
|---|---|
| Publication number | US-2018239686-A1 |
| Application number | US-201815895686-A |
| Country | US |
| Kind code | A1 |
| Filing date | Feb 13, 2018 |
| Priority date | Feb 20, 2017 |
| Publication date | Aug 23, 2018 |
| Grant date | — |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
The disclosure provides an input and output recording device and method, CPU and data read and write operation method thereof. The input and output recording device is provided between a central processor CPU and a peripheral, and is configured to record data read and write operations between the CPU and the peripheral, wherein the data read and write operations comprise a data read and write operation initiated by the peripheral and a data read and write operation initiated by the CPU; the input and output recording device is further configured to request the CPU to process the data read and write operation initiated by the peripheral, and upon receiving an instruction sent by the CPU, send a data packet of the data read and write operation initiated by the peripheral to the CPU. The disclosure can accurately record the data read and write operation between the CPU and the peripheral, so as to eliminate the influence of uncertainty caused by the asynchronous data read and write operations initiated by the peripherals, and provide a basis for the input and output security checking of the CPU.
Opening claim text (preview).
What is claimed is: 1 . An input and output recording device, wherein the input and output recording device is provided between a central processor CPU and a peripheral, and is configured to record data read and write operations between the CPU and the peripheral, the data read and write operations comprise a data read and write operation initiated by the peripheral and a data read and write operation initiated by the CPU; wherein the input and output recording device is further configured to request the CPU to process the data read and write operation initiated by the peripheral, and upon receiving an instruction sent by the CPU, send a data packet of the data read and write operation initiated by the peripheral to the CPU. 2 . The input and output recording device of claim 1 , wherein the input and output recording device is further configured to request the CPU to process the data read and write operation initiated by the peripheral when the data packet of the data read and write operation initiated by the peripheral stored in the input and output recording device reaches a preset threshold. 3 . The input and output recording device of claim 1 , wherein the input and output recording device is further configured to request the CPU to process the data read and write operation initiated by the peripheral using an interrupt mode. 4 . The input and output recording device of claim 1 , wherein the input and output recording device is further configured to obtain an identification of the peripheral and determine whether to record the data read and write operation between the CPU and the peripheral according to the identification of the peripheral. 5 . The input and output recording device of claim 1 , wherein the input and output recording device is further configured to obtain a transaction identification of the data packet of the data read and write operation between the CPU and the peripheral, and determine whether the data read and write operation between the CPU and the peripheral is the data read and write operation initiated by the peripheral according to the transaction identification. 6 . The input and output recording device of claim 1 , wherein the input and output recording device comprises: a first partition configured to record a data packet flowing from the peripheral to the CPU; and a second partition configured to record a data packet flowing from the CPU to the peripheral. 7 . The input and output recording device of claim 6 , wherein: the first partition is further configured to organize the recorded data packet flowing from the peripheral to the CPU according to the type of the data read and write operation; and the second partition is further configured to organize the recorded data packet flowing from the CPU to the peripheral according to the type of the data read and write operation. 8 . The input and output recording device of claim 7 , wherein the first partition comprises: a first sub-region for recording the data packet flowing from the peripheral to the CPU of Memory mapped I/O (MMIO) type; a second sub-region for recording the data packet flowing from the peripheral to the CPU of Direct Memory Access (DMA) type; a third sub-region for recording the data packet flowing from the peripheral to the CPU of Peer to Peer (P2P) type; and a fourth sub-region for recording other type of the data packet flowing from the peripheral to the CPU except for the MMIO type, the DMA type and the P2P type; and wherein the second partition comprises: a fifth sub-region for recording the data packet flowing from the CPU to the peripheral of MMIO type; a sixth sub-region for recording the data packet flowing from the CPU to the peripheral of DMA type; a seventh sub-region for recording the data packet flowing from the CPU to the peripheral of P2P type; and an eighth sub-region for recording other type of the data packet flowing from the CPU to the peripheral except for the MMIO type, the DMA type and the P2P type. 9 . The input and output recording device of claim 1 , wherein the input and output recording device comprises: a trace buffer configured to record the data read and write operation between the CPU and the peripheral, the data read and write operation comprises the data read and write operation initiated by the peripheral and the data read and write operation initiated by the CPU; and a pause buffer configured to request the CPU to process the data read and write operation initiated by the peripheral, and upon receiving the instruction sent by the CPU, send the buffered data packet of the data read and write operation initiated by the peripheral to the CPU through the trace buffer. 10 . An input and output recording method, comprising: recording data read and write operations between a central processor CPU and a peripheral, the data read and write operations comprising a data read and write operation initiated by the peripheral and a data read and write operation initiated by the CPU; and requesting the CPU to process the data read and write operation initiated by the peripheral, and upon receiving an instruction sent by the CPU, send a data packet of the data read and write operation initiated by the peripheral to the CPU. 11 . The input and output recording method of claim 10 , wherein the requesting the CPU to process the data read and write operation initiated by the peripheral comprises: requesting the CPU to process the data read and write operation initiated by the peripheral when the data packet of the stored data read and write operation initiated by the peripheral reaches a preset threshold. 12 . The input and output recording method of claim 10 , wherein the requesting the CPU to process the data read and write operation initiated by the peripheral comprises: requesting the CPU to process the data read and write operation initiated by the peripheral using an interrupt mode. 13 . The input and output recording method of claim 10 , further comprising: obtaining an identification of the peripheral; and determining whether to record the data read and write operation between the CPU and the peripheral according to the identification of the peripheral. 14 . The input and output recording method of claim 10 , further comprising: obtaining a transaction identification of the data packet of the data read and write operation between the CPU and the peripheral; and determining whether the data read and write operation between the CPU and the peripheral is the data read and write operation initiated by the peripheral according to the transaction identification. 15 . A central processor, comprising: a request processing module configured to suspend execution of current instruction stream upon receiving a request sent by an input and output recording device; an instruction sending module configured to send an instruction to the input and output recording device to instruct the input and output recording device to send a data packet of a data read and write operation to be processed; and a data processing module configured to receive the data packet of the data read and write operation to be processed which is sent by the input and output recording device, and complete the data read and write operation to be processed. 16 . The central processor of claim 15 , wherein the request processing module is further configured to record current instruction position and the data read and write operation to be processed, wherein the data read and write operation is a data read and write operation initiated by the peripheral.
to assure secure computing or processing of information · CPC title
Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title
for interfaces, buses · CPC title
for I/O devices · CPC title
Circuit details, i.e. tracer hardware · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.