Hardware Performance Counter Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious behavior in connected objects are resource-intensive and require prior modeling of legitimate and malicious operations, making them inefficient for monitoring fleets of connected objects with limited resources.
Innovation Solution
A method that utilizes hardware performance counters (HPCs) to generate time series of values, which are then processed to obtain statistical vectors and abnormality scores, allowing for anomaly detection without the need for pre-modeling legitimate or malicious operations, by comparing these scores across connected objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If remote attestation or software-based detection methods are used to detect attacks on connected objects, then detection capability is improved, but resource consumption increases significantly
Solution Approach 1:
The patent extracts only the essential hardware performance counter data from the complex system state, focusing monitoring on specific CPU performance indicators (instruction cache misses, branch prediction failures, etc.) rather than monitoring the entire system state. This selective extraction reduces resource consumption while maintaining effective attack detection capability.
Solution Approach 2:
The patent creates a simplified representation of system state through hardware performance counters, which are copyable and comparable data structures that capture essential execution characteristics without requiring deep inspection of actual code or memory states. This copying approach enables efficient comparison between legitimate and malicious execution patterns.
2Measurement precision
If hardware-based remote attestation techniques are used to detect deviations from intended behavior, then detection accuracy is improved, but deployment cost and complexity increase
Solution Approach 1:
The patent makes the existing hardware performance counters serve multiple functions: they not only provide detection data but also enable both legitimate operation monitoring and attack detection using the same counters. This multi-functionality eliminates the need for separate dedicated attestation hardware while maintaining high detection accuracy through statistical analysis of counter patterns.
Solution Approach 2:
The patent transforms raw hardware counter values into statistical parameters (means, standard deviations, percentiles) that capture execution characteristics. By changing from raw data to statistical representations, the system achieves high detection accuracy while simplifying processing requirements and deployment complexity.
3Adaptability or versatility
If software-based detection methods are used to verify program execution, then implementation flexibility is improved, but resource usage increases significantly
Solution Approach 1:
The patent replaces complex software-based verification mechanisms with hardware-level performance counter monitoring. Instead of using software to analyze program behavior directly, the system uses hardware counters to collect execution statistics, which are then processed statistically to detect anomalies. This substitution dramatically reduces resource usage while maintaining flexibility through configurable counter selection and statistical analysis parameters.
Data Source
Figure 1~2
AI summary
The invention relates to a method for monitoring a fleet of connected objects comprising a processing circuit which comprises a plurality of hardware performance counters (CPM) characterising a function of the processing circuit. The method comprises: a) selecting at least one portion of the plurality of CPMs, b) obtaining, for each connected object and for each CPM, a time series of values relating to the CPM and the connected object, c) obtaining, for each time series of values, a vector of statistical values, d) obtaining, for each connected object, an abnormality score from a comparison of the vectors of statistical values relating to the object with the set of vectors of statistical values, and e) in the event of detecting an abnormality score of a given connected object deviating beyond a predefined threshold, detecting a computer operating anomaly of the given connected object.