Method for monitoring an electronic system using low-level performance counters and comprising at least one set of uncontrolled software applications that are executed on a processor, and a monitoring device

Description

[0001] The present invention relates, in general, to the field of securing electronic systems by anomaly detection, and more specifically to the methods and apparatus for the control of an embedded electronic platform capable of supporting one or more software applications not controlled by the industrialist who created the platform.

[0002] Indeed, it is necessary to ensure that these applications behave as expected and also that they do not try to take advantage of the system developed by the manufacturer, the risks being, for example: reverse engineering of the technology of the manufacturer who produced the computer system: code, know-how...; recovery of secret elements of the manufacturer: certificates, keys...; misappropriation of the system for purposes not intended by the manufacturer.

[0003] It is important to note that customers have the freedom to install the applications they want and that once the systems are delivered to customers, the manufacturer will no longer have the opportunity to examine in detail each software that customers use.

[0004] The aim is therefore to monitor the behavior of uncontrolled applications by observing their interactions with the system.

[0005] We are familiar with antivirus programs, most of which compare binary signatures to databases of known malware signatures. However, this approach is not satisfactory because it is impossible to create and maintain an up-to-date database of all malware.

[0006] Hardware Performance Counters (HPCs), also known as HPCs, are present in most modern processor (Intel, ARM, AMD) and GPU (NVIDIA) architectures. Their primary use is code optimization. However, their function can be repurposed for software monitoring. These counters have already been used to observe specific abnormal behaviors, such as detecting ROP attacks or cache-based attacks. For example, US patent 2019 / 0130101 describes a method for detecting side-channel attacks, including Spectre and Meltdown attacks.

[0007] US 2018 / 018456 A1 describes a device for controlling the operation of an electronic system comprising a set of applications.

[0008] US 2015 / 161024 A1 describes a method for checking the resilience of a machine learning model against a cyber-attack.

[0009] US 2019 / 347410 A1 describes a system for controlling the operation of an electronic system comprising a set of applications.

[0010] There is a need to further increase the security of computer systems hosting uncontrolled applications.

[0011] To this end, according to a first aspect, the invention proposes a method for controlling the operation of an electronic system according to claim 1.

[0012] For example, in the case of a smartphone, a smart TV or even a game console, the device and the method make it possible to ensure that the application used by the running client is indeed a legitimate application and not a malicious process.

[0013] The approach according to the invention differs from previous ones in at least two ways. The first is that it focuses on platform control and not exclusively on the detection of known and targeted attacks. This more general approach leads to the second point: introducing a notion of causality by taking into account the user's actions from the learning phase onward to predict the actual action of the device.

[0014] In some embodiments, the control method according to the invention is according to claim 2 or 3.

[0015] According to a second aspect, the present invention provides a computer program according to claim 4.

[0016] According to a third aspect, the present invention proposes a device for controlling the operation of an electronic system according to any one of claims 5 to 7.

[0017] According to a fourth aspect, the present invention proposes an electronic system according to claim 8.

[0018] These features and advantages of the invention will become apparent upon reading the following description, given solely by way of example, and made with reference to the accompanying drawings, in which: [ Fig 1 ] there figure 1 represents a view of a computer system in one embodiment of the invention; [ Fig 2 ] there figure 2 is a flowchart of steps implemented in an embodiment of the invention; [ Fig 3 ] there figure 3 is a view illustrating the stages of the figure 2 in an embodiment of the invention; [ Fig 4 ] there figure 4 is a functional view of a learning module implemented in an embodiment of the invention; [ Fig 5 ] there figure 5 is a view illustrating the training of the MOD feat and MOD INV models of the figure 4 in an embodiment of the invention; [ Fig 6 ] there figure 6 is a view illustrating the training of the MOD FWD model of the figure 4 in an embodiment of the invention; [ Fig 7 ] there figure 7 is a view illustrating the constitution of the reference database in one embodiment of the invention; [ Fig 8 ] there figure 8 is a view of the whole of 200 steps of a process in an embodiment of the invention.

[0019] There figure 1 represents an electronic system 1 in one embodiment of the invention, for example a smartphone 1. In other embodiments, system 1 will be, for example, a computer, a tablet, a connected television ("smart TV"), an embedded electronic system (for example, road or air navigation)...

[0020] The computer system 1 comprises one or more applications from a set 11 of applications APP1, APP2, APP3 ..., a processing module 10 comprising a monitoring unit 13, a memory 14, a processor 15, a reference database 16 and an electronic anomaly detection module 17.

[0021] The electronic anomaly detection module 17 includes an HPC prediction model 20.

[0022] The application set 11 under consideration includes, for example, one or more applications, possibly user-loadable, from among an electronic waveform supply block adapted to generate a waveform, a radio block using said waveform delivered by the electronic waveform supply block, a vocoder electronic block, a cryptography block ... each of these blocks includes a software part reacting to user actions of the system and including software instructions executing on the processor 15 or giving rise to the execution of software instructions on the processor 15.

[0023] It should be noted that user actions in their interface with the applications of application set 11 give rise to sub-actions. For example, when the user launches the firefox® process, this triggers numerous actions performed by the latter, including an encryption process to verify the HTTPS of the page. The level of granularity of each action considered according to the invention is defined (for an encryption process, for example, a single "action" label may suffice, or the action may be divided into sub-actions, such as key generation, key storage, etc.).

[0024] The monitoring unit 13 is a processor performance monitoring unit and includes the so-called HPC (hardware performance counters) registers, which are known to be adapted to count the number of occurrences of hardware activities, such as the total number of instructions, the total number of branches, the total number of cycles, and the total number of L3 cache accesses. The performance reading can be associated with a process P and is performed at a frequency f.

[0025] The vector comprising the values ​​of each HPC register considered at time t will be referred to as HPC(t) hereafter. The time series of HPC(t) between time T-1 and time T is denoted sT. The delay T0 of the time window between T-1 and T is, for example, 10 ms, and the number of HPC(t) samples in the time window is approximately 20 points per window for N windows, typically N = 5. These parameters are adjustable, notably according to the operating frequency of the process being monitored. Similarly, it is also important to note that a change of basis can be performed, and we can obtain the values ​​of one HPC register as a function of another HPC register.

[0026] On the figure 2 , a set of 100 steps implemented according to the invention is represented.

[0027] In a preliminary step 101, aimed at generating an HPC 20 prediction model and a reference database enabling the detection of malfunctions in a system capable of hosting applications from set 11 of applications, such as system 1: A machine learning process is implemented during substep 101_1, illustrated in figure 3 , on an electronic learning platform (not shown), providing the HPC prediction model 20; and the reference database 16 is created, during a substep 101_2 illustrated in figure 3 .

[0028] In one embodiment, system 1 is constrained, i.e., the field of the set 11 of applications that can be accommodated is limited; these applications come, for example, from customers using system 1 or from COTS (not shown) integrated into system 1, and step 101 of the process according to the invention is applied to build an anomaly detection module 17 constructed according to this limited field of applications that can be accommodated.

[0029] In substep 101_1, based on test input data representative of the expected behaviors (excluding undesired behaviors) of the applications in application set 11, and including series of HPC values ​​over time windows, and the user actions (and corresponding sub-actions) (referenced act) occurring during these time windows, the HPC prediction model 20 is generated by machine learning; the prediction error ε between the test HPC values ​​of a series s T+1 and the HPC values ​​predicted between T and T+1 by the model being built 200 from the test series s T and the actions that occurred in the corresponding time window, between TN and T, is iteratively backpropagated (arrow 30) in the prediction model then being built (block 200).

[0030] The HPC 20 prediction model is an algorithmic function predicting the value of the HPC series from t=T to T+1 as a function of the series of HPC values ​​from t=TN to T and the actions occurring during this same time window.

[0031] In substep 101_2, with reference to the figure 3 , the reference database 16 is constituted, comprising, classified for each type of action, typical characteristics of the error existing between the test HPC values ​​and the HPC values ​​predicted by the HPC prediction model 20 from substep 101_1. These typical characteristics are determined from time series of tests of HPC values ​​and user actions.

[0032] In one embodiment, the typical characteristics are formalized by a histogram, called a reference histogram, indicating on the abscissa the error values ​​and on the ordinate the number of occurrences N OCC of each error value occurring for example, during a window of duration T0, at a precision D.

[0033] The machine learning and reference database building platform 16 includes, for example, a database to store test data, working memory and a processor, as well as at least one neural network (e.g., deep learning type) or any new technologies related to time series.

[0034] Then, in a later operational phase of nonconformity detection, also called the inference phase, during the operation of system 1 as used by the user, the set of 200 steps shown in figure 2 , comprising steps 102, 103 and 104, is implemented by the electronic anomaly detection module 17 integrating the prediction model 20 and the reference database 16 from step 101.

[0035] During step 102, the anomaly detection module 17 obtains from the monitoring unit 13 the current values ​​of the HPC counters sampled over successive observation windows and it also obtains the user actions that occurred during these time windows.

[0036] During step 103, these HPC actions and values ​​for each series s T to s TN, relative to each observation window from t= T-1 to T, are provided as input to the HPC prediction model 20, which predicts as a function the future HPC values ​​from t= T to T+1.

[0037] Then, during step 104, the anomaly detection module 17: Calculates the error between the current values ​​obtained and the predicted values ​​over the observation window; deduces the corresponding error characteristics, in this case the error histogram; extracts the reference error histograms classified in the reference database 16 corresponding to each action obtained in step 102; compares the error histogram calculated from the current observation window with each extracted histogram and determines, based on the discrepancies observed during the comparison, whether or not there is an anomaly in the current behavior of system 1; if an anomaly is detected, triggers an alert to be handled according to the security policy configurable by an administrator. For example, logging an alert, or stopping the application.

[0038] For example, the presence or absence of an anomaly is decided by performing a Kolmogorov-Smirnov test according to p-value P KS between the distributions of the compared histograms.

[0039] With reference to the figure 3 The set of 200 steps 102 to 104 is illustrated: in a standard case, referenced 200_s and corresponding to an absence of anomaly, the calculated histogram being referenced 35, an extracted reference histogram being referenced 33, the comparison 36 giving rise to a decision D of absence of anomaly; in a case of anomaly detection, referenced 200_a, the calculated histogram being referenced 35', the extracted reference histogram being referenced 33, the comparison 36' giving rise to a decision D' of presence of anomaly.

[0040] In one embodiment, the memory 14 includes a set of software instructions, which, when executed on the processor 15, implement the set of steps 200 described above.

[0041] In another embodiment, the anomaly detection module 17 is each implemented as a programmable logic component, such as an FPGA (Field Programmable Gate Array), or as a dedicated integrated circuit, such as an ASIC (Applications Specific Integrated Circuit).

[0042] Low-level observation of the application, using High-Performance Computing (HPC), allows for the collection of a significant amount of data that accurately characterizes System 1 and its operation. The solution is based on a pipeline that detects changes in system behavior according to a specific set of requirements. To achieve this, the solution includes a training phase for the machine learning model (deep or shallow) in a blank area according to the expected criteria, followed by a second phase of building an indexed database based on the user application's actions. This database stores the model's prediction error histogram on standard and predefined time series, and finally, a real-world evaluation phase. The concept of causality through user action is integrated into the model from the training phase onward.

[0043] By taking actions into account, the invention makes it possible to detect anomalies related to application usage that deviates from expected behavior. It addresses the need for system control provided to a client, rather than solely the need for attack detection. Furthermore, it provides improved interpretability of the results generated by the control module.

[0044] A particular embodiment is now described with reference to figures 4 à 8 , taking into consideration that in the time series s T of HPC values, two types of information are contained: (1) user actions (and induced sub-actions) that the HPC 20 prediction model cannot control but that affect it; (2) things out of the control of the model and the user and that should not affect the HPC 20 prediction model.

[0045] Furthermore, it is assumed here that N=1, but any integer value of N greater than 1 can also be chosen.

[0046] Type 1 information includes, for example, the action of changing / stopping one process to launch another, loading libraries, writing data to memory, reading data from memory, compressing files, encrypting files...

[0047] Type 2 information includes, for example, environmental determinism), a process going to sleep to perform other background processes such as updates, a slowdown of the phone, its aging, a rise in temperature.

[0048] A representation space for data must model type 1 information and not be affected by type 2 information.

[0049] To this end, in a particular embodiment, the machine learning and reference database building platform 16 comprises the processing module 40 represented in figure 4 , which is used to implement step 101.

[0050] The processing module 40 includes models and a subtractor 44. The models of the processing module 40 are shown on the figure 4 in their learning form: they are thus respectively named prediction model (MOD FWD 200), inverse model (MOD INV 430), and extraction model 420 (MOD FEAT 200), and correspond once their respective machine learning is completed, respectively to the prediction model MOD FWD 20, inverse model MOD INV 43, and extraction model MOD feat 42.

[0051] The MOD feat 420 extraction model is suitable for extracting useful information, i.e. type 1 information, from the HPC vectors of each observation series st and for condensing it into a vector Φ(st).

[0052] The MOD FWD 20 model is adapted to predict Φ(s t+1 ) as a function of Φ(st ) and the user action at the time, named act(t): we name Φ^(s t+1 ) this result of prediction of Φ(s t+1 ) by MOD FWD 20 as a function of Φ(st ) and act(t).

[0053] The subtractor 44 calculates the difference between Φ^(s t+1 ) and Φ(s t+1 ), constituting the prediction error ε described above relative to substep 101_1, which will be back-propagated in the MOD FWD 20 prediction model.

[0054] The inverse model MOD INV 43 is adapted to determine the action act(t) as a function of Φ(st ) and Φ(s t+1 ). The determined action is named act^(t).

[0055] In such an embodiment, in the prior step 101, machine learning therefore takes place in two stages in substep 101_1.

[0056] Initially, machine learning of the MOD feat 420 and MOD INV 43 models takes place, as shown in figure 5 , using the user action or subsequent sub-actions: the BDD5 300 database contains time series s T, called training time series, of HPC values ​​and corresponding actions corresponding to "legal" processes, i.e. expected, controlled behaviors which are given in training to the model being built ("MOD feat 420"); the resulting predictions Φ^(s T+1 ) are given in training to the model (MOD INV 430) then being built; the predictions of actions act^(T) are compared with the actions act(T) and the prediction errors from the comparison to each time series considered are back-programmed (arrow 303) in the two models being trained (MOD feat 420 for the error on Φ) and (MOD INV 430 for the error on the action).

[0057] Then, in a second step, the machine learning of the MOD FWD 20 prediction model takes place, as schematically represented in figure 6 The BDD6 600 database (which, in this case, is the same as the BDD5 300 in FIG 5 ) includes time series s T, called training series, of HPC values ​​and corresponding actions corresponding to "legal" processes, i.e., expected, controlled behaviors which are used in training the MOD FWD prediction model then under construction (block "(MOD FWD 200)"); the representation Φ(s T+1 ) is determined by the MOD feat 42 model as a function of s T+1; the representation Φ(s T ) determined by the MOD feat 42 model as a function of s T is given to the MOD INV 43 model which estimates the action act^(T) as a function of this Φ(s T ); Φ(s T ) and act^(T) are given as input to the MOD FWD model then under construction (block "(MOD FWD 200)") which then determines Φ^(s T+1 ) as a function of these inputs; and the error between Φ^(s T+1 ) and Φ(s T+1 ) is back-programmed (arrow 700) in the model being trained MOD FWD (block (MOD FWD 200)).

[0058] For example, the MOD feat 42 model can be implemented using machine learning with an LSTM (Long Short-Term Memory) recurrent neural network. For instance, an autoencoder-type model is used for the MOD FWD 20 model, and a multilayer perceptron-type model is used for the MOD INV 43 model. However, these models can be generalized to other models: Transformer, VAE, etc.

[0059] In substep 101_2, the reference database 16 is constructed as schematically represented in figure 7 The BDD7 700 database contains training time series s T, HPC values, and corresponding actions representing "legal" processes, i.e., expected, controlled behaviors. The representation Φ(s T+1) is determined by the MOD feat 42 model as a function of s T+1. The representation Φ(s T) determined by the MOD feat 42 model as a function of s(T) is given to the MOD INV 43 model, which estimates the action act^(T) as a function of this Φ(s T). Φ(s T) and act^(T) are given as input to the MOD FWD 20 model, which then determines Φ^(s T+1) as a function of these inputs. The error histogram between Φ^(s T+1) and Φ(s T+1) is estimated. The dotted lines in figure 7 illustrate the indexing of database 16 by act^(T) and Φ(s T).

[0060] Reference error histograms per action are thus determined and classified by action in the reference database 16.

[0061] There figure 8 illustrates, in the particular embodiment considered, the operational anomaly detection phase, during the operation of the system 1 comprising the electronic anomaly detection module 17 comprising the MOD FWD 20, MOD feat 42 (and optionally MOD INV 43) models and the database 16 resulting from the operations described above with reference to figures 4-7The time series s(T) of HPC values ​​and corresponding actions corresponding to indeterminate processes (i.e., potentially "legal" or not) are successively provided as input to the electronic anomaly detection module 17; the representation Φ(T+1) is determined by the MOD model feat 42 as a function of s(T+1); the representation Φ(s T) determined by the MOD model feat 42 as a function of s(T) is given to the MOD INV model 43 which estimates the action act^(T) as a function of this Φ(s T); Φ( s T ) and act^(T) (or the collected action act(T) depending on the embodiment) are given as input to the MOD FWD model 20 which then determines Φ^(s T+1 ) as a function of these inputs; and the current error histogram between Φ^( s T+1 ) and Φ(s T+1 ) is calculated as a function of the differences between Φ^( s T+1 ) and Φ(s T+1 ).The electronic anomaly detection module 17 extracts from the database 16 the reference histogram corresponding to the action act^(T) (or the collected action act(T) according to the embodiment modes) and the comparison 800 between the reference and current histograms allows the electronic anomaly detection module 17 to detect the presence or absence of an anomaly.

[0062] It should be noted that the MOD FWD 20 model is learned from the Φ(t) representation extracted from the HPC(t) data and not directly from the time series s T of HPC values. Furthermore, during the evaluation phase 200, the prediction is also performed using the Φ(ST) representation. The prediction error in the specific implementation described is deduced not from experimental HPC values, but from their Φ(s) representation. This latter representation may contain an error, however small. The model's strength lies in its robustness to this error. These provisions reduce the number of false positives and improve the interpretation of the results.

[0063] In one embodiment, the reference base 16 includes histograms relating to benign and malignant processes, labeled as such, thus allowing a filtering policy to be established either in white list mode or in black list mode depending on the needs of the system.

[0064] Thus the invention proposes a control solution, in the form of a method or a device, for an electronic system comprising a set of client applications not controlled by the administrator of the electronic system, allowing control of the conformity of each client application to the control policy put in place by the administrator based on the recording of the values ​​of the HPCs for each application and the nominal action expected of the client application.

[0065] In some embodiments, it exhibits at least some of the characteristics described below.

[0066] It relies on a module for recording and organizing HPCs, enabling the recording of HPC values ​​of application-related processes and the organization of said values ​​in time windows s T in the form of a value matrix.

[0067] A calculation module allows predicting for an application a representation of its future state from the current state of the application characterized by the windows s TN to s T and the expected action A T, or sub-action, of the application.

[0068] An error histogram generator generates error histograms between the predicted representation state and the actual representation state.

[0069] A reference database is indexed by the action, or sub-action, and the state of the application being analyzed.

[0070] An analysis module detects the presence or absence of an anomaly in the readings and is responsible for raising an alert.

[0071] The HPC survey and organization module collects HPCs attached to a process P according to time windows s T during a range T0 at a frequency f; in addition, the value matrix produced by the module may include a time indication; the survey module may also be based on the number of CPU cycles to time the sampling.

[0072] The calculation module contains, for example, three models: the first being the useful information extractor Φ(s T ) from the input s T recorded by the recording and organization module; the second being the predictor of the action, or sub-action, of the user a T from Φ(s T ), the third predicts the useful information at time t+1: Φ^(s T+1 ) from Φ(s T ).

[0073] The models used by the computing module are based on a recurrent neuronal cell mechanism for the first model, on any model using attention mechanisms for the first and second models, and on any model from the family of autoencoders, deterministic or Bayesian, for the third model.

[0074] The histogram generator calculates, for example, the histogram, to a desired precision D, of the quadratic, absolute, or other error between Φ^(s T+1 ) and Φ(s T+1 ), said histogram representing the deviation of the estimation of the useful information of the time series.

[0075] The reference database contains, for example, benign or malignant scenarios of calibration histograms, these histograms representing the deviation of the estimation of useful information of the time series for controlled applications, and being indexed by the actions, or sub-actions, a T and Φ(s T).

[0076] The analysis module first finds the reference histogram in the database closest to Φ(s T), then performs the Kolmogorov-Smirnov test to establish the probability P KS that the histograms come from the same distribution, and finally compares this probability to the confidence value α, between 0 and 100, which can be set by the platform administrator and represents the level of requirement desired by the administrator. If P KS < α, the module triggers an alert to be dealt with according to the security policy configurable by the administrator.

[0077] An initial phase consists sequentially of a learning phase carried out by a specific training module, followed by a phase of building the reference database.

[0078] The learning phase includes the following steps: obtaining the training data, time series s T and actions or sub-actions, associated with a T for all T and taken from a set of reference applications for learning using the HPCs recording and organization module; implementation of a first machine learning process generating, as a function of input data s T and output a T, for all T, the first two algorithmic models of the computing module providing firstly Φ(s T) and then secondly the estimated action classes; following this, implementation of a second machine learning process generating, using the third model of the computing module, as a function of input data Φ(s TN ) up to Φ(s T ) and output Φ(s T+1 ), for all T, the value Φ^(s T+1 ).The reference database construction phase includes the following steps: obtaining the reference database construction data, time series s T and actions or sub-actions, associated with T for all T and taken from a set of calibration applications for the construction of the reference database using the HPCs collection and organization module; obtaining by the calculation module in the evaluation phase values ​​D(s T+1 ) and Φ^(s T+1 ) for each T; obtaining by the histogram generator the deviation histogram for each T between Φ(s T+1 ) and Φ^(s T+1 ); indexing the previous histogram and thus, for all T, creation of the reference database.In the subsequent phase, anomaly detection includes: obtaining the data in the test phase, time series s T and actions or sub-actions, associated with T for any T and generated using the HPC collection and organization module; obtaining by the calculation module in the evaluation phase the values ​​Φ(s T+1 ) and Φ^(s T+1 ) for each T; obtaining by the histogram generator the deviation histogram for each T between Φ(s T+1 ) and Φ^(s T+1 ); obtaining, by the analysis module, the reference histogram in the database closest to Φ(s T ), then by the Kolmogorov-Smirnov test, obtaining the probability P KS, then comparison with the configurable confidence parameter α.

Claims

1. A method for monitoring the operation of an electronic system (1) comprising a set (11) of applications, a processor (15) on which each application of the set of applications is executed following user actions of the system, the system calculating successive counter values of a set of performance counters HPC of the processor taken following said user actions; said method comprising the following steps during an operational monitoring phase: - prediction by a first algorithmic model of next HPC values depending on input data of said model comprising current calculated HPC values; said first model being derived from a first machine learning process implemented during a preliminary phase and generating, depending on training input data comprising successive HPC values, said first algorithmic model (20); - verify the compliance of the system operation by an electronic control module (17) depending on characteristic(s) of a first calculated deviation between first calculated values of the processor HPC performance counters and first HPC values predicted by the first algorithmic model; and triggering an alert by said electronic control module upon detection of a non-compliance; during the operational phase, the input data of said first model further comprising at least user actions, said first determined algorithmic model predicts next HPC values depending on current HPC values and at least user actions; said first model having been trained, during the preliminary phase, on input data of said first machine learning further comprising at least user actions from among a list of determined actions, said method being characterized in that: according to which, during the preliminary phase and at the end of the training phase, the following steps are implemented using an electronic processing module (10): - obtaining, during test windows, time series of test HPC counter values and respective associated user actions; - for each obtained test time series associated with a user action, providing, by the algorithmic model, a corresponding time series of predicted HPC values depending on said obtained time series and the associated user action; - calculating the deviation between each obtained test time series and the corresponding predicted value time series; - determining, depending on said calculated deviations, a reference deviation database indicating, for each user action of the determined list, respective reference deviation characteristics; and according to which during the subsequent phase, the detection of non-compliance comprises: - selecting, in the reference deviation database, reference deviation characteristic(s) corresponding to a user action associated with said first current values; and - comparing said selected reference deviation characteristic(s) with the first deviation.

2. The method for monitoring the operation of an electronic system (1) according to the preceding claim, according to which the reference deviation characteristic, respectively of a first deviation, comprises a reference histogram of the number of occurrences of deviations depending on deviation values and the comparison between said selected reference deviation characteristic(s), and a first deviation comprises the comparison between those of said histograms.

3. The method for monitoring the operation of an electronic system (1) according to claim 1 or 2, comprising the following steps: - during the preliminary phase, implementing a second machine learning process generating, depending on training input data comprising successive HPC values and corresponding actions of the determined list, a second algorithmic model; - said second algorithmic model provides as output, depending on the input data of said second model comprising said HPC values, a representation of each HPC value from which has been removed, what is decorrelated from the actions of the determined action list; and - the first algorithmic model (20) is trained, during the first machine learning process, depending on the representations, provided by the second algorithmic model of successive HPC values.

4. A computer program including software instructions which, when executed by a computer, implement a method according to any one of the preceding claims.

5. The monitoring device (10) for the operation of an electronic system (1) comprising a set (11) of applications, a processor (15) on which each application of the set of applications is executed following user actions of the system, the system then calculating successive values of counters of a set of performance counters HPC of the processor taken following said user actions; said monitoring device being able to predict, by a first algorithmic model, next HPC values depending on input data of said model comprising current calculated HPC values; said first model being derived from a first machine learning process implemented during a preliminary phase and generating, depending on training input data comprising successive HPC values, said first algorithmic model (20); said monitoring device being able to verify the compliance of the system operation depending on characteristic(s) of a first calculated deviation between first calculated values of the processor HPC performance counters and first predicted HPC values; said monitoring device being able to trigger detection of a non-compliance; said monitoring device being able to predict by said first algorithmic model next HPC values depending on current HPC values and at least user actions, the input data of said first model further comprising user actions and said first model having been trained, during the preliminary phase, on data input of said first machine learning further comprising at least user actions from among a list of determined actions, the monitoring device being able to, during the preliminary phase and at the end of the training phase, obtain, during test windows, time series of test HPC counter values and respective associated user actions; said monitoring device being characterized in that: said device being able to provide, for each obtained test time series associated with a user action, predict, by the algorithmic model, a corresponding time series of HPC values depending on said obtained time series and the associated user action, to calculate the deviation between each obtained test time series and the corresponding predicted value time series and to determine, depending on said calculated deviations, a reference deviation database indicating, for each user action of the determined list, the respective reference deviation characteristics; said monitoring device being able to, during the subsequent phase, select in the reference deviation database, the reference deviation characteristic(s) corresponding to a user action associated with said first current values and compare said selected reference deviation characteristic(s) and those of the first deviation.

6. The monitoring device (10) according to the previous claim, wherein the reference deviation characteristic, respectively of the first deviation, comprises a reference histogram of the number of occurrences of deviations depending on the deviation values, and the monitoring device is able to compare said selected reference deviation characteristic(s) and first deviation by comparing between them said histograms.

7. The monitoring device (10) in the operation of an electronic system (1) according to claim 5 or 6, able to, during the preliminary phase, implement a second machine learning process generating, depending on training input data comprising successive HPC values and corresponding actions of the determined list, a second algorithmic model; said monitoring device being able to provide, by said second algorithmic model, depending on input data of said second model comprising said HPC values, a representation of each HPC value from which has been removed what is decorrelated from the actions of the determined action list; and said monitoring device being able to train the first algorithmic model (20), during the first machine learning process, depending on the representations, provided by the second algorithmic model, of successive HPC values.

8. An electronic system (1) comprising a set (11) of applications, a processor (15) on which each application of the set of applications is executed following user actions of the system, the system calculating the successive counter values of a set of performance counters HPC of the processor taken following said user actions, the electronic system including a monitoring device according to one of claims 5 to 7.