HPC-Based Application Monitoring for Unknown Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures for electronic systems hosting uncontrolled applications are inadequate, as they fail to detect unknown threats and do not account for user actions, leading to risks such as reverse engineering, misappropriation, and unauthorized system use.
Innovation Solution
A method and device utilizing Hardware Performance Counters (HPCs) for anomaly detection, incorporating machine learning to predict expected application behaviors based on user actions, and building a reference database to identify deviations from expected norms, triggering alerts for anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus programs using binary signature comparison are used, then known malware can be detected, but unknown threats cannot be detected and the database cannot be kept up-to-date
Solution Approach 1:
The patent replaces the mechanical signature-matching system with a machine learning-based behavioral analysis system. Instead of comparing binary signatures against a database, the system uses hardware performance counters to collect runtime behavioral data and applies machine learning models to detect anomalies, enabling detection of unknown threats without requiring pre-existing signature databases.
Solution Approach 2:
The patent changes the monitoring parameters from high-level binary signatures to low-level hardware performance counter metrics (cache misses, branch predictions, instruction counts). This parameter transformation enables the system to capture subtle behavioral patterns that distinguish malicious from benign applications, providing both detection accuracy and adaptability to unknown threats.
2Productivity
If hardware performance counters are used for code optimization, then system performance can be improved, but the system cannot monitor application behavior for security purposes
Solution Approach 1:
The patent makes hardware performance counters serve dual purposes: their original function for code optimization and a new function for security monitoring. By collecting the same performance metrics for both compilation optimization and runtime behavioral analysis, the system achieves security monitoring capability without adding separate specialized hardware, maintaining productivity while enabling reliability.
3Reliability
If the manufacturer tries to examine each customer software in detail, then security can be ensured, but customers lose freedom to install desired applications and the manufacturer cannot examine software after delivery
Solution Approach 1:
The patent implements a self-service security monitoring system where the hardware performance counters automatically collect behavioral data and the machine learning models autonomously analyze patterns to detect anomalies. This eliminates the need for manufacturer intervention in examining customer software, preserving customer freedom while maintaining security through automated behavioral analysis.
4Measurement precision
If low-level hardware performance counters are monitored, then precise behavioral analysis can be achieved, but the complexity of collecting and analyzing counter data increases
Solution Approach 1:
The patent extracts only the most relevant hardware performance counter metrics needed for behavioral analysis (cache misses, branch predictions, instruction counts) rather than collecting all available counters. This selective extraction maintains measurement precision for detecting malicious behaviors while reducing the complexity of data collection and analysis by focusing on the most discriminative features.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Method that monitors the operation of a system executing, on a processor, applications following user actions and that computes HPC values, comprising the following steps: - predicting, using an algorithmic model, next HPC values depending on current HPC values and on the actions; said model being the result of a machine learning process based on input training data comprising successive HPC values and actions; - verifying the conformity of operation of the system using an electronic monitoring module (17) depending on one or more characteristics of a computed first deviation between computed HPC values and HPC values predicted by the first algorithmic model; and triggering an alarm using said electronic monitoring module on detection of a non-conformity.