Behavior sensor for creating consumable events

Abstract

A behavior sensor for creating consumable events may include a feature extractor coupled to receive an event stream of events executed by circuitry, where the feature extractor identifies features of a particular event of the event stream and associates the particular event with time; and a classifier coupled to receive a feature of the particular event from the feature extractor, where the classifier classifies the particular event as a classified event associated with the time using a predefined category based on the received feature of the particular event; thereby, the classified events extracted from the event stream over a time range and subsequent classified events are appended in a time sequence forming the consumption events.

Description

Background Art

[0001] A central processing unit (CPU) with performance monitoring capabilities, such as a performance monitoring unit (PMU), has the ability to generate detailed information about operations performed by the CPU. This detailed information is typically tracked in terms of "events", which are results of processor execution, particularly negative results, such as branch misses, cache misses, but also in terms of positive events, such as completed (retired) instructions, e.g., branch retirements, store retirements, and load retirements. Unfortunately, modern processors run at extremely high speeds, so even if only some of the results of processor execution are tracked, millions of events are still generated per second, if not more.

[0002] The large number of events (e.g., millions of events) generated in a short amount of time (e.g., within a second) can make it difficult for other devices or processes to consume the information. One approach taken by some PMUs is to aggregate the events, such as using a counter or accumulator that counts each type of event over a predetermined time (usually on the order of millions of cycles). Unfortunately, the approach of using accumulators to count events in a given timeframe discards fine timing information and the order of events—both of which may be important to the device or process that is to consume the information. Summary of the invention

[0003] Behavioral sensors for creating consumable events are provided. The behavior of a circuit such as a processor or other device, including the success of a command or a particular operation, can be represented as a series of events in an event stream. The described behavioral sensors can be used to interpret the events in the event stream and manage the interpreted events in a more immediately consumable manner. Finer temporal fidelity can be achieved by associating individual events from the event stream with time. Once associated, events associated with time can be organized in a consumable time sequence. The time sequence can be better used by a mitigation or diagnostic component to more accurately understand the internal workings of a processor or other device.

[0004] A behavioral sensor for creating a consumable event may include: a feature extractor coupled to receive an event stream of events executed by a circuit, wherein the feature extractor identifies features of a specific event of the event stream and associates the specific event with a time; and a classifier coupled to receive features of the specific event from the feature extractor, wherein the classifier classifies the specific event as a classified event associated with the time using a predefined category based on the received features of the specific event; thereby, the classified events extracted from the event stream and subsequent classified events within a time range are appended in a time series that forms a consumable event.

[0005] A method for creating a consumable event may include receiving an event stream of events executed by a circuit; identifying characteristics of a specific event of the event stream; associating the specific event with time; classifying the specific event as a classified event associated with time using a predefined category; and appending the classified event associated with time to a time sequence that forms a consumable event.

[0006] This summary is provided to introduce a series of concepts in a simplified form, which are further described in the detailed description below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 An operating environment for a behavior sensor for creating consumable events is illustrated.

[0008] Figure 2A and 2B The operation of generating consumable events from a PMU compared to aggregate events is illustrated.

[0009] Figure 3 A representative schematic diagram illustrating a behavioral sensor for creating a consumable event.

[0010] Figure 4 Demonstrates methods for creating consumable events.

[0011] Figure 5 Specific embodiments of a system with a behavioral sensor for creating consumable events are illustrated. DETAILED DESCRIPTION

[0012] Behavioral sensors for creating consumable events are provided. The behavior of a circuit such as a processor or other device, including the success of a command or a particular operation, can be represented as a series of events in an event stream. The described behavioral sensors can be used to interpret the events in the event stream and prompt the interpreted events in a more immediately consumable manner. Finer temporal fidelity can be achieved by associating individual events from the event stream with time. Once associated, events associated with time can be organized in a consumable time sequence. The time sequence can be better used by a mitigation or diagnostic component to more accurately understand the internal workings of a processor or other device.

[0013] Figure 1An operating environment for a behavior sensor for creating consumable events is illustrated. The behavior sensor 100 can receive an event stream of events related to the actions of a circuit such as a processor 110. Although specific reference is made to the processor 110, the processor can be any processing element, such as, but not limited to, a CPU, a graphics processing unit (GPU), a microcontroller, or a computational unit (e.g., a multiplier-accumulator (MAC) unit with a memory). Similarly, it should be understood that a behavior sensor (e.g., behavior sensor 100) can receive events from (and can be used to create consumable events from) other circuits, such as, but not limited to, memory controllers, cache controllers, bus interface units (e.g., PCLe), network interface controllers, mixed signal blocks (e.g., for a radio interface), and digital filters. The behavior sensor 100 can be described with respect to Figure 3 The event stream of events may be, for example, a bit stream generated by a PMU that monitors and records the actions of the processor. Events may describe problems that occurred during the execution of commands from the processor 110. Events may include, but are not limited to, branch mispredictions, load retirements, store retirements, branch retirements, and cache misses. Events may be 1-bit information or multi-bit signals (e.g., 2-bit, 3-bit). Events may be PMU events, come from a variety of sources, or may be derived from a combination of existing sources. The behavior sensor 100 may process the events of the event stream to create consumable events, for example, as described with respect to Figure 4 The consumable event may be stored in the memory 120 or immediately used by another system or device.

[0014] For example, consumable events generated by behavioral sensor 100 can be provided to or obtained by diagnostic system 130 or security system 140. Diagnostic system 130 refers to a system that evaluates the performance and / or debugging of a processor. Performance tuning involves changing system parameters based on a predicted workload to improve the behavior of a computing system (e.g., a processor). Debugging involves identifying known process patterns in program behavior and can be performed as part of a post-manufacturing process before the processor is launched. Security system 140 provides security monitoring to identify potential attacks on the processor.

[0015] The diagnostic system 130 can analyze the consumable event set to determine whether there is a problem, and if so, what the problem may be. One application of the diagnostic system 130 relates to power management, where the efficiency of the workload can be optimized while the processor is running. For example, in a performance tuning application, the diagnostic system 130 analyzes the consumable event set to view the results of different loads applied to the processor 110. Based on the results of the different loads applied to the processor 110, the diagnostic system 130 can provide feedback to the processor 110 to change the processor function based on changes in event frequency or event type. As another example, in a debugging application, the diagnostic system 130 analyzes the consumable event set so that known defect modes of processor execution can be identified and iteratively tested.

[0016] The security system 140 can examine the consumable event set to determine whether an attack is occurring or has occurred and implement countermeasures at the processor 110. The security system 140 can be configured, for example, to detect patterns of classified events known to exhibit attack characteristics, potentially in real time. If the security system 140 determines that an attack is ongoing, mitigation can be triggered directly, such as direct feedback to the processor 110 (e.g., the processor terminates the application) or direct feedback to the monitoring system (on the system-on-chip where the behavior sensor 100 and the processor 110 are located or off-chip) or otherwise create or issue an alarm. The alarm can be used in additional applications for tuning and other improvements.

[0017] As described above, instead of aggregating / counting events, the behavior sensor 100 can generate consumable events that maintain time information and event order, which is beneficial for various applications.

[0018] Figure 2A and 2B The operation of generating consumable events from a PMU compared to aggregating events is illustrated. A specific example of an event stream includes events generated by a PMU monitoring a processor. Figure 2A In an illustrative example of a scenario where aggregated events are generated to track branch mispredictions (bm), cache misses (cm), and instruction retirements (ir), a counter at a PMU may aggregate event information over, for example, 100 events, and the results are classified by a classifier. A first sample of 100 events shows 25 bm, 50 cm, and 25 ir. A second sample of 100 events shows similar 25 bm, 50 cm, and 25 ir. A classifier may be used to identify whether a sample reflects a known pattern. Conversely, referring to Figure 2B, as described herein, a behavioral sensor captures time information and sequence information. In the illustrative case of tracking branch mispredictions (bm), cache misses (cm), and instruction retirements (ir), information from the event trace is used to generate consumable events by the behavioral sensor. Here, each cycle in which the tracked event occurs is captured and is appended with information indicating the time. As an optimization method, the information indicating the time can be an incremental value of the number of cycles since the previous event. For example, the first incident of the tracked event (ir) during the sampling / time range is assigned a time of 0. The next incident of the tracked event (cm in this case) occurring in cycle 3 is assigned a time increment of 3. The next incident of the tracked event (ir in this case) occurring in cycle 5 is assigned a time increment of 2 (which is the number of cycles since the previous event). The behavioral sensor can store the information as an event vector with bits indicating the time value of the tracked event.

[0019] Figure 3 A representative schematic diagram illustrating a behavior sensor for creating consumable events. Figure 3 , the behavior sensor 300 includes a feature extractor 310 and a classifier 320. The feature extractor 310 may be coupled to a processor (or other device) to receive an event stream of events executed by the processor. The feature extractor 310 identifies features of a particular event of the event stream and associates the particular event with time. In some cases, a buffer (not shown) is used to capture information before being acted upon by the feature extractor 310. In some cases, a robust feature extractor is used that can handle direct reception of events from an event trace.

[0020] The feature extractor 310 can be implemented as a programmable binary state machine, a binary pattern matching engine, a bitstream pattern matcher, a path signature extractor, a digital filter, a statistical calculator, or other suitable circuits (including more robust / complex circuits with or without acceleration). A programmable binary state machine is a simple state machine that checks events bit by bit and marks one or more features based on the traversal of the state machine. A bitstream pattern matcher compares portions of an event that are larger than a single bit, and can even compare entire events. A bitstream pattern matcher can be embodied as a series of enabled circuits configured for a specific bitstream. A path signature extractor uses high-dimensional data associated with a series of events to generate a unique signature of a path representing important aspects related to the series of events.

[0021] As described above, the feature extractor 310 identifies features of a particular event of the event stream and associates the particular event with a time. These features can be used for any event of interest. For example, the features of a particular event can include at least two features monitored by the PMU (e.g., at least two features from a set of features that can include branch mispredictions, load retirements, store retirements, branch retirements, and cache misses). The time can be measured using a counter, which can be part of a behavioral sensor or maintained externally (e.g., as part of the processor). In some cases, the time can be an absolute measure, such as the hour, minute, second, and date of the event. In other cases, the time can be a relative measure, such as using delta compression (e.g., see Figure 2B In delta compression, a relative time difference value may be stored - the difference between the current event and the previous event may be expressed by the number of empty or unused cycles - for example, 3 cycles after the previous event. In the case of a relative metric, in some cases the number of cycles may have an upper limit, such as 1,000 cycles (e.g., even if there are 10,000 cycles between consecutively reported events, the relative time will be reported and saved as 1,000 cycles). This may be accomplished, for example, by using a saturating counter to count the time between events.

[0022] The classifier 320 is coupled to the feature extractor 310 to receive the features of the specific event from the feature extractor 310. The classifier 320 classifies the specific event into a classified event associated with time using a predefined category based on the features of the received specific event. The classification of the predefined category may include a confidence value so that the classification is not a simple binary determination (e.g., belonging to the category or not belonging to the category), but a quantitative classification metric (e.g., a value between 0 and 255, including 0 and 255, where 0=clearly does not belong to the category and 255=clearly belongs to the category). The classified events and subsequent classified events extracted from the event stream by the feature extractor 310 within the time range are attached to the time sequence forming the consumable event. In some cases, the output of the classifier 320 is in the form of a label vector (e.g., a value associated with each predefined category or a subset of predefined categories). The classifier 320 may be a nearest neighbor classifier / approximate nearest neighbor classifier, a decision tree classifier, a support vector machine, or other suitable classifiers. In some cases, the classifier 320 may include behavioral locality sensitive hashing (bLSH), which is locality sensitive hashing and a hash table lookup for approximate nearest neighbor search or extreme gradient boosting (Xg boosting). The classifier 320 may be implemented using a designated processor. The consumable events output from the behavior sensor 300 after classification by the classifier 320 are events classified by time.

[0023] Although some implementations of behavior sensor 300 include only feature extractor 310 and classifier 320, other implementations may include, for example, Figure 5 Additional circuits and / or subsystems described. In some cases, intermediate values ​​of behavior sensor 300 may be output or otherwise obtained, for example, where the output of feature extractor 310 is derivable.

[0024] Figure 4 Demonstrates methods for creating consumable events. Figure 4 , a method 400 for creating a consumable event may include receiving (410) an event stream of events; identifying (420) characteristics of a particular event of the event stream; associating (430) the particular event with a time; classifying (440) the particular event as a classified event associated with the time using a predefined category; and appending (450) the classified event associated with the time to a time sequence forming the consumable event.

[0025] Method 400 may be performed by a behavioral sensor (e.g. Figure 3 The feature extractor 310 may receive (410) an event stream of events executed by a processing element or other circuit, identify (420) features of a particular event of the event stream, and associate (430) the particular event with a time. The time may later be used as an indicator of the time series. In some cases, identifying (420) features of the particular event may include comparing bits of the particular event to a known bit pattern that identifies the particular feature. Example features of the event may include branch mispredictions, cache misses, and load retirements.

[0026] The classifier 320 can then be used to classify (440) the specific event into a classified event associated with the time using the predefined categories; the classified event associated with the time is then appended (450) to the time sequence forming the consumable event. In some cases, the classification is performed using an approximate nearest neighbor algorithm. The approximate nearest neighbor algorithm can use a similarity function to determine the category closest to the feature set by minimizing the "distance" value between potential categories (in other words, the degree to which the category is similar to the feature set).

[0027] As about Figure 1As described, consumable events can be used by a variety of systems. For example, the time sequence generated by method 400 can be sent to the diagnostic system 130 to perform analysis on the time sequence to determine any problems that exist in the code or circuit. In some cases, only a portion of the time sequence is sent. For example, once a predetermined number of cycles have passed, the time sequence can be sent. In other cases, the time sequence can be sent based on the execution of the processor's command. For example, the time sequence can be sent after the processor 110 executes the entire functional block of the code or at a specific time defined in the code.

[0028] As another example, the time series may be sent to security system 140, which checks the time series for potential activity indicating the presence or past presence of an attack. The transmission of the time series may occur similarly to the transmission to diagnostic system 130 (eg, partially or fully at certain times).

[0029] Method 400 may also include grouping certain received events of the event stream before forming the consumable event. For example, grouping certain received events of the event stream may include grouping the received events of the event stream according to an exception level, a process identifier, a thread identifier, or a combination thereof. That is, in some cases, the events received by the behavior sensor can be grouped by an exception level and / or a process ID (or a thread ID, where the process is not used, such as in a kernel).

[0030] An exception level refers to the level of privilege regarding software execution (e.g., availability and access to memory and processor functions). There are many different types of exception levels, including but not limited to secure monitor, hypervisor, kernel, user, trusted kernel, and trusted application.

[0031] Exception levels exist in specific hardware, and exception level changes can be logged as events. Additional collection / reporting functions can be included for process IDs or thread IDs.

[0032] The sensor may collect certain information / events that may be stored in certain storage resources (e.g., registers, buffers), or the sensor may be provided with information. For example, a processor's scheduler may report to a behavior sensor that information (e.g., a process identifier or a thread identifier) ​​is available in a particular resource. As a specific example, the Linux operating system provides a configuration option: CONFIG_PID_IN_CONTEXTIDR, which places the process ID in a CPU register called Context IDR. The sensor may receive or otherwise obtain the process ID from a CPU register.

[0033] Figure 5A specific embodiment of a system having a behavior sensor for creating a consumable event is illustrated. Figure 5 , the computing system may include a CPU core 500 and system interfaces and peripherals 510. The CPU core 500 may include a PMU 502 and a memory 504. The CPU core 500 may execute commands / instructions stored in the memory 504. When executing commands / instructions, certain activities, operations, and behaviors at the CPU core 500 and the system interfaces and peripherals 510 may be considered events.

[0034] Multiple sensors may be distributed throughout the computing system to detect various events and states. For example, one or more sensors 512 may be located at the system interface and peripherals 510, one or more sensors 514 may be located at the CPU core 500, one or more sensors 516 may be located at the CPU core 500 for monitoring by the PMU 502, and one or more sensors 518 may be located in association with the memory 504 (e.g., cache and memory management, etc.). In the illustrated scenario, a behavior sensor 520 is included to create consumable events from events detected by the various sensors 512, 514, 516, 518 for a pattern detector 530 for a security alert.

[0035] The behavior sensor 520 includes a feature extractor 522 and a classifier 524, which can be described in detail with reference to FIG. Figure 3 540 . The pre-processing circuit may be included (and considered to be part of the behavior sensor 520 or part of the circuit coupled to the processor / CPU core 500). The pre-processing circuit may include an event selector 542, a cycle-delta compressor 544, and one or more buffers 546. Of course, some embodiments may omit one or more of these circuit elements, and some embodiments may include additional circuit elements in addition to or in place of the event selector 542, the cycle-delta compressor 544, and the one or more buffers 546.

[0036] The event selector 542 may receive input of events of the event stream from one or more sources (e.g., from any one of the sensors 512, 514, 516, 518) and select events based on one or more criteria. The criteria may include the type of processor command, the number of cycles, or other predefined constraints. The event selector 542 is used to constrain the complexity of the feature extractor 522 so that the feature extractor 522 works according to a subset of the signal. That is, the event selector 542 provides a reduced event stream to the feature extractor 522. The event selector 542 may be embodied as a multiplexer, wherein the selection line of the multiplexer may determine whether an event on the bus line of the multiplexer is allowed to pass. The selection pin may be controlled externally, such as by a processor that is gated to allow only certain events to pass. In other cases, the selection pin may be coupled to a specific sensor or PMU to allow only events from a specific source. In other cases, a specific bit of the event may be fed to the selection pin (e.g., an event including seven bits may include six bits of data about the event and one bit used as a flag). In another implementation, the event selector may be a bitmask that combines multiple event sources into a single bitstream (eg, combining loads and stores into a single "load or store" event).

[0037] When relative time is used as the time value in a time series to determine the number of cycles between valid events, a cycle delta compressor 544 (see, e.g. Figure 2B ). Because the CPU does not generate events on every cycle, the delta compressor 544 can be used to compress zero space using run-length encoding. That is, the delta compressor 544 can count the number of empty samples and save this increment as a cycle increment from the previous non-empty sample. In this way, the cycle delta compressor 544 generates a count of multiple empty cycles between events of the event stream. The delta compressor 544 may include a counter (e.g., in the form of multiple flip-flops connected in cascade). The counter may be incremented regularly, such as by a clock circuit. When a valid event is received, the counter may be read and the value (i.e., the time difference between two valid events) may be stored as time and forwarded with the event. The counter may then be reset. In some cases, the counter used in the delta compressor 544 may be a saturated counter, including an upper limit value, beyond which the counter cannot be incremented. For example, the upper limit value may be 1000 cycles-if the event occurs more than 1000 cycles after the immediately preceding valid event, a value of 1000 cycles may be specified as time, regardless of whether the actual number of cycles is greater than 1000.

[0038] One or more buffers 546 can be used to slow down the reception of events. In some cases, events are generated at a higher rate than the rate that feature extractor 522 or classifier 524 can handle. In order to prevent these events from being discarded or conflicting with the events currently being processed, buffer 546 can be used to store events until feature extractor 522 or classifier 524 are ready. Buffer 546 can be, for example, a digital buffer, a storage resource, a static random access memory (SRAM) or a trigger circuit. In some cases, buffer 546 automatically pushes the received events to feature extractor 522, and in other cases, buffer 546 receives a signal from feature extractor 522 or classifier 524, which indicates that the previous event has been processed by one or both of feature extractor 522 and classifier 524. In some cases, additional buffers may exist between feature extractor 522 and classifier 524.

[0039] Additional event collection systems 550 may be included as part of the system (wherein consumable events are provided to the pattern detector 530), each additional event collection system including their own buffer 552, periodic delta compressor 554, event selector 556, feature extractor 558, and classifier 560.

[0040] The pattern detector 530 can be considered as such Figure 1 In some cases, pattern detector 530 may be a higher order machine learning or statistical system implemented, for example, using neural networks, deep learning techniques. Pattern detector 530 may perform high level decisions on mitigation and reporting.

[0041] Although the subject matter is described in language specific to structural features and / or actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Instead, the specific features and actions described above are disclosed as examples of implementing the claims, and other equivalent features and actions are intended to fall within the scope of the claims.

Claims

1. A behavior sensor for creating a consumable event, the behavior sensor comprising: a feature extractor coupled to receive an event stream of events executed by the circuit, wherein the feature extractor identifies features of particular events of the event stream and associates the particular events with time; as well as a classifier coupled to receive the features of the specific event from the feature extractor, wherein the classifier classifies the specific event as a classified event associated with the time using a predefined category based on the received features of the specific event; Thereby, the classified event and subsequent classified events extracted from the event stream within a time range are appended in a time sequence forming the consumable event.

2. The behavior sensor of claim 1, wherein the circuit is a processing element.

3. The behavior sensor according to claim 2, wherein the processing element is a central processing unit (CPU).

4. The behavior sensor of claim 1, further comprising an event selector coupled to the feature extractor to provide a reduced event stream to the feature extractor.

5. The behavior sensor of claim 4, wherein the event selector is a multiplexer that receives an input of events of the event stream from one or more sources and selects a subset of events from the event stream based on one or more criteria.

6. The behavior sensor of claim 4, wherein the event selector comprises a bit mask that merges multiple event sources into a single event stream.

7. The behavior sensor of claim 1 further comprising a cycle delta compressor coupled between the circuit and the feature extractor, wherein the cycle delta compressor generates a count of the number of empty cycles between events of the event stream.

8. The behavior sensor of claim 1, further comprising a counter for counting a number of periods between instances of an event, the number of periods between instances of an event being the time associated with the particular event.

9. The behavior sensor of claim 8, wherein the counter is a saturation counter having an upper limit value.

10. The behavior sensor of claim 1, wherein the feature extractor comprises a programmable binary state machine.

11. The behavior sensor of claim 1, wherein the feature extractor comprises a binary pattern matching engine.

12. The behavior sensor of claim 1, wherein the feature extractor comprises a path signature extractor.

13. The behavior sensor of claim 1, wherein the characteristics of the specific event include at least two characteristics monitored by a performance monitoring unit (PMU).

14. The behavior sensor of claim 1, wherein the classifier comprises an approximate nearest neighbor classifier.

15. A method for creating a consumable event, the method comprising: receiving an event stream of events executed by the circuit; identifying characteristics of a particular event of the event stream; relating said particular event to a time; categorizing the specific event as a classified event associated with the time using a predefined category; as well as The classified event associated with the time is appended to a time sequence forming the consumable event.

16. The method for creating a consumable event according to claim 15, wherein classifying the specific event comprises performing an approximate nearest neighbor algorithm on the specific event.

17. The method of creating a consumable event of claim 15, wherein associating the specific event with the time comprises associating a relative time for the specific event, the relative time being the number of cycles since a previous cycle containing an event.

18. The method of creating a consumable event according to claim 15, further comprising grouping specific received events of the event stream before forming the consumable event.

19. The method for creating consumable events according to claim 18, wherein grouping specific received events of the event stream comprises grouping the received events of the event stream according to an exception level, a process identifier, a thread identifier, or a combination thereof.

Images