Detection of compromise through automated power analysis

    公开(公告)号:GB2587762A

    公开(公告)日:2021-04-07

    申请号:GB202100941

    申请日:2019-07-24

    Applicant: IBM

    Abstract: A method and system for determining a power consumption pattern for at least one application being executed on a computer is provided. The method comprises measuring a DC current and measuring a DC supply voltage provided to a data processing device, thereby creating a stream of time-stamped voltage value samples and current value samples. The method comprises further determining a product of the streams at identical times and converting the product into a real and an imaginary data stream using I/Q digital signal processing, combining these into a complex data stream, applying a signal processing demodulation step to the complex data stream, thereby generating a demodulated data stream, and extracting from the demodulated data stream at least one stream-based parameter signature, the at least one stream-based parameter signature representing the power consumption pattern of the at least one corresponding application being executed on the data processing device.

    DETECTION OF COMPROMISE THROUGH AUTOMATED POWER ANALYSIS

    公开(公告)号:GB2587762B

    公开(公告)日:2021-10-06

    申请号:GB202100941

    申请日:2019-07-24

    Applicant: IBM

    Abstract: A method and system for determining a power consumption pattern for at least one application being executed on a computer is provided. The method comprises measuring a DC current and measuring a DC supply voltage provided to a data processing device, thereby creating a stream of time-stamped voltage value samples and current value samples. The method comprises further determining a product of the streams at identical times and converting the product into a real and an imaginary data stream using I/Q digital signal processing, combining these into a complex data stream, applying a signal processing demodulation step to the complex data stream, thereby generating a demodulated data stream, and extracting from the demodulated data stream at least one stream-based parameter signature, the at least one stream-based parameter signature representing the power consumption pattern of the at least one corresponding application being executed on the data processing device.

    System and method for SIEM rule sorting and conditional execution

    公开(公告)号:GB2598214A

    公开(公告)日:2022-02-23

    申请号:GB202111756

    申请日:2020-04-28

    Applicant: IBM

    Abstract: A method for processing security events by applying a rule-based alarm scheme may be provided. The method includes generating a rule index of rules and an indicator of compromise index for each of the rules. The method includes also processing the incomingsecurity event by applying the rules, increasing a current rule counter relating to a triggered rule, and increasing a current indicator of compromise counter pertaining to the triggered rule. Furthermore, the method includes generating a pseudo security event from received data about known attacks and related indicators of compromise, processing the pseudo security events by sequentially applying the rules, increasing a current rule counter of pseudo security events, and increasing a current indicator of compromise counter for pseudo security events, and sorting the rules and sorting within each rule the indicator of compromise values in the indicator of compromise index.

Patent Agency Ranking