Detection of anomalous program execution using hardware-based micro architectural data

Abstract

Disclosed are devices, systems, apparatus, methods, products, media and other implementations, including a method that includes obtaining hardware-based micro-architectural data, including hardware-based micro-architectural counter data, for a hardware device executing one or more processes, and determining based, at least in part, on the hardware-based micro-architectural data whether at least one of the one or more processes executing on the hardware device corresponds to a malicious process. In some embodiments, determining based on the hardware-based micro-architectural data whether the at least one of the one or more processes corresponds to a malicious process may include applying one or more machine-learning procedures to the hardware-based micro-architectural data to determine whether the at least one of the one or more processes corresponds to the malicious process.

What is claimed is: 
     
         1 . A method comprising:
 obtaining hardware-based micro-architectural data representative of a trace of micro-architectural activities performed by a process executing on a hardware device over a time period, the hardware-based micro-architectural data including hardware-based microarchitectural counter data; and   determining based on the hardware-based micro-architectural data representative of the micro-architectural activities performed by the process executing on the hardware device over the period of time, and on multiple data sets of micro-architectural data representative of respective traces of activities performed by different anomalous processes executable on the hardware device during respective time periods, whether the process executing on the hardware device corresponds to one of the different anomalous processes.   
     
     
         2 . The method of  claim 1 , wherein the hardware-based micro-architectural data comprises hardware-based time-varying micro-architectural counter data, wherein the time-varying micro-architectural counter data measures events that occur on one or more circuits of the hardware device, with the events being internal to one or more processors executing the process, the events being counted on one or more counters of the one or more processors, and the one or more counters being configured to count the events. 
     
     
         3 . The method of  claim 1 , further comprising:
 in response to a determination that the process executing on the hardware device corresponds to one of the different anomalous processes, performing one of:   terminating the execution of the process,   shutting down the hardware device,   reporting detection of the one of the different anomalous processes to a user, or migrating one or more of the process executing on the hardware device or another sensitive computation executing on the hardware device to another computation platform.   
     
     
         4 . The method of  claim 1 , wherein determining whether the process executing on the hardware device corresponds to one of the different anomalous processes comprises:
 applying one or more machine-learning procedures, trained using the multiple data sets of micro-architectural data representative of respective traces of activities performed by the different anomalous processes executable on the hardware device during the respective time periods, on the hardware-based micro-architectural data to determine whether the process corresponds to the one of the different anomalous processes.   
     
     
         5 . The method of  claim 4 , wherein the one or more machine learning procedures comprise one or more of: a k-nearest neighbor procedure, a decision tree procedure, a random forest procedure, an artificial neural network procedure, a tensor density procedure, or a hidden Markov model procedure. 
     
     
         6 . The method of  claim 1 , wherein determining whether the process executing on the hardware device corresponds to one of the different anomalous processes comprises:
 determining invariancy between the hardware-based micro-architectural data to the multiple data sets of micro-architectural data representative of the respective traces of activities performed by the different anomalous processes executable on the hardware device during the respective time periods to determine whether the process corresponds to the one of the different anomalous processes.   
     
     
         7 . The method of  claim 1 , wherein determining whether the process executing on the hardware device corresponds to one of the different anomalous processes comprises:
 performing one of a heuristic process or a non-heuristic process on the hardware-based microarchitectural data to determine whether the process corresponds to the one of the different anomalous processes.   
     
     
         8 . The method of  claim 1 , further comprising:
 obtaining updates for the multiple data sets of micro-architectural data representative of the respective traces of activities performed by the different anomalous processes.   
     
     
         9 . The method of  claim 8 , wherein obtaining the updates comprises:
 downloading encrypted data for the multiple data sets of micro-architectural data representative of the respective traces of activities performed by the different anomalous processes to an antivirus engine in communication with the hardware device providing the hardware-based micro-architectural data;   decrypting at the antivirus engine the downloaded encrypted data for the multiple data sets of micro-architectural data representative of respective traces of activities performed by the different anomalous processes; and   updating a revision counter maintained by the antivirus engine indicating a revision number of a most recent update of the multiple data sets of micro-architectural data representative of the respective traces.   
     
     
         10 . The method of  claim 1 , wherein obtaining the hardware-based micro-architectural data comprises:
 obtaining the hardware-based micro-architectural data at various time instances.   
     
     
         11 . The method of  claim 10 , wherein obtaining the hardware-based micro-architectural data at the various time instances comprises:
 performing one or more of a data push operation initiated by the hardware device to send the micro-architectural data, or a data pull operation, initiated by an antivirus engine, to send the micro-architectural data.   
     
     
         12 . The method of  claim 1 , wherein obtaining the hardware-based micro-architectural data comprises:
 obtaining multi-core hardware-based micro-architectural data resulting from execution of the process on a processor device with multiple processor cores executing multiple processes; and   correlating the respective hardware-based micro-architectural data obtained from each of the multiple processor cores to the multiple processes.   
     
     
         13 . The method of  claim 1 , wherein the one of the different anomalous processes comprises one or more of: a malware process, or a side-channel attack process. 
     
     
         14 . A system for detection of anomalous program execution, the system comprising:
 a hardware device executing one or more processes; and   an antivirus engine in communication with the hardware device, the antivirus engine configured to:
 obtain hardware-based micro-architectural data representative of a trace of micro-architectural activities performed by a process, from the one of the one or more processes executing on the hardware device, over a time period, the hardware-based micro-architectural data including hardware-based microarchitectural counter data; and 
 determine based on the hardware-based micro-architectural data representative of the micro-architectural activities performed by the process executing on the hardware device over the period of time, and on multiple data sets of micro-architectural data representative of respective traces of activities performed by different anomalous processes executable on the hardware device during respective time periods, whether the process executing on the hardware device corresponds to one of the different anomalous processes. 
   
     
     
         15 . The system of  claim 14 , wherein the hardware-based micro-architectural data comprises hardware-based time-varying micro-architectural counter data, wherein the time-varying micro-architectural counter data measures events that occur on one or more circuits of the hardware device, with the events being internal to one or more processors executing the process, the events being counted on one or more counters of the one or more processors, and the one or more counters being configured to count the events. 
     
     
         16 . The system of  claim 14 , wherein the antivirus engine configured to determine whether the process executing on the hardware device corresponds to one of the different anomalous processes is configured to:
 apply one or more machine-learning procedures, trained using the multiple data sets of micro-architectural data representative of respective traces of activities performed by the different anomalous processes executable on the hardware device during the respective time periods, on the hardware-based micro-architectural data to determine whether the process corresponds to the one of the different anomalous processes.   
     
     
         17 . The system of  claim 16 , wherein the one or more machine learning procedures comprise one or more of: a k-nearest neighbor procedure, a decision tree procedure, a random forest procedure, an artificial neural network procedure, a tensor density procedure, or a hidden Markov model procedure. 
     
     
         18 . The system of  claim 14 , wherein the antivirus engine configured to determine whether the process executing on the hardware device corresponds to one of the different anomalous processes is configured to perform one or more of:
 determine invariancy between the hardware-based micro-architectural data to the multiple data sets of micro-architectural data representative of the respective traces of activities performed by the different anomalous processes executable on the hardware device during the respective time periods to determine whether the process corresponds to the one of the different anomalous processes; or   perform one of a heuristic process or a non-heuristic process on the hardware-based microarchitectural data to determine whether the process corresponds to the one of the different anomalous processes.   
     
     
         19 . The system of  claim 14 , wherein the antivirus engine is implemented at one of: a module of the hardware device, or a remote system different from the hardware device. 
     
     
         20 . A non-transitory computer readable media comprising computer instructions executable on a programmable device to:
 obtain hardware-based micro-architectural data representative of a trace of micro-architectural activities performed by a process executing on a hardware device over a time period, the hardware-based micro-architectural data including hardware-based microarchitectural counter data; and   determine based on the hardware-based micro-architectural data representative of the micro-architectural activities performed by the process executing on the hardware device over the period of time, and on multiple data sets of micro-architectural data representative of respective traces of activities performed by different anomalous processes executable on the hardware device during respective time periods, whether the process executing on the hardware device corresponds to one of the different anomalous processes.