Side-channel attack detection using hardware performance counters

    公开(公告)号:US11194902B2

    公开(公告)日:2021-12-07

    申请号:US16234085

    申请日:2018-12-27

    Abstract: The present disclosure is directed to systems and methods of detecting a side-channel attack using hardware counter anomaly detection circuitry to select a subset of HPCs demonstrating anomalous behavior in response to a side-channel attack. The hardware counter anomaly detection circuitry includes data collection circuitry to collect data from a plurality of HPCs, time/frequency domain transform circuitry to transform the collected data to the frequency domain, one-class support vector anomaly detection circuitry to detect anomalous or aberrant behavior by the HPCs. The hardware counter anomaly detection circuitry selects the HPCs having reliable and consistent anomalous activity or behavior in response to a side-channel attack and groups those HPCs into a side-channel attack detection HPC sub-set that may be communicated to one or more external devices.

    Methods and apparatus for detecting a side channel attack using hardware performance counters

    公开(公告)号:US11188643B2

    公开(公告)日:2021-11-30

    申请号:US16234144

    申请日:2018-12-27

    Abstract: Methods, apparatus, systems and articles of manufacture for detecting a side channel attack using hardware performance counters are disclosed. An example apparatus includes a hardware performance counter data organizer to collect a first value of a hardware performance counter at a first time and a second value of the hardware performance counter at a second time. A machine learning model processor is to apply a machine learning model to predict a third value corresponding to the second time. An error vector generator is to generate an error vector representing a difference between the second value and the third value. An error vector analyzer is to determine a probability of the error vector indicating an anomaly. An anomaly detection orchestrator is to, in response to the probability satisfying a threshold, cause the performance of a responsive action to mitigate the side channel anomaly.

    Deep learning on execution trace data for exploit detection

    公开(公告)号:US10915631B2

    公开(公告)日:2021-02-09

    申请号:US15922868

    申请日:2018-03-15

    Abstract: Technologies disclosed herein provide for converting a first data of a first control flow packet to a first pixel, where the first data indicates one or more branches taken during a known execution of an application, generating an array of pixels using the first pixel and one or more other pixels associated with one or more other control flow packets generated from the known execution, transforming the array of pixels into a series of images, and using a machine learning algorithm with inputs to train a behavior model to identify a malicious behavior in an unknown execution of the application. The inputs include one or more images of the series of images and respective image labels assigned to the one or more images. More specific embodiments include extracting the first control flow packet from an execution trace representing at least part of the known execution.

    Adversarial attack prevention and malware detection system

    公开(公告)号:US10733294B2

    公开(公告)日:2020-08-04

    申请号:US15700489

    申请日:2017-09-11

    Inventor: Li Chen

    Abstract: Systems and methods may be used to classify incoming testing data, such as binaries, function calls, an application package, or the like, to determine whether the testing data is contaminated using an adversarial attack or benign while training a machine learning system to detect malware. A method may include using a sparse coding technique or a semi-supervised learning technique to classify the testing data. Training data may be used to represent the testing data using the sparse coding technique or to train the supervised portion of the semi-supervised learning technique.

    TRUST MODEL FOR MALWARE CLASSIFICATION
    17.
    发明申请

    公开(公告)号:US20190272375A1

    公开(公告)日:2019-09-05

    申请号:US16367611

    申请日:2019-03-28

    Inventor: Li Chen

    Abstract: There is disclosed in one example an apparatus, including: a hardware platform including a processor and a memory; an image classifier to operate on the hardware platform, the image classifier configured to classify an object under analysis as one of malware or benignware based on an image of the object; and a trust component configured to identify portions of the image that contribute to the classification.

    DEEP LEARNING ON EXECUTION TRACE DATA FOR EXPLOIT DETECTION

    公开(公告)号:US20190042745A1

    公开(公告)日:2019-02-07

    申请号:US15922868

    申请日:2018-03-15

    Abstract: Technologies disclosed herein provide for converting a first data of a first control flow packet to a first pixel, where the first data indicates one or more branches taken during a known execution of an application, generating an array of pixels using the first pixel and one or more other pixels associated with one or more other control flow packets generated from the known execution, transforming the array of pixels into a series of images, and using a machine learning algorithm with inputs to train a behavior model to identify a malicious behavior in an unknown execution of the application. The inputs include one or more images of the series of images and respective image labels assigned to the one or more images. More specific embodiments include extracting the first control flow packet from an execution trace representing at least part of the known execution.

    MALWARE DETECTION AND CLASSIFICATION USING ARTIFICIAL NEURAL NETWORK

    公开(公告)号:US20190042743A1

    公开(公告)日:2019-02-07

    申请号:US15843900

    申请日:2017-12-15

    Inventor: Li Chen

    Abstract: An apparatus for computing is presented. In embodiments, the apparatus may include a converter to receive and convert a binary file into a multi-dimensional array, the binary file to be executed on the apparatus or another apparatus. The apparatus may further include an analyzer coupled to the converter, the analyzer to process the multi-dimensional array to detect and classify malware embedded within the multi-dimensional array using at least one partially retrained artificial neural network having an input layer, an output layer and a plurality of hidden layers between the input and output layers. The analyzer may further output a classification result, and the classification result may be is used to prevent execution of the binary file on the apparatus or on another apparatus.

Patent Agency Ranking