Power Consumption Pattern Detection for Malware Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In server virtualization environments, detecting anomalies in power consumption patterns becomes challenging due to the mix of application patterns and hypervisor activities, making it difficult to identify which guest operating systems are infected with malicious software.
Innovation Solution
A computer-implemented method and system that measure DC current and voltage using sensors, convert the data into real and imaginary streams through I/Q digital signal processing, and apply demodulation to extract stream-based parameter signatures representing power consumption patterns, allowing for the detection of malicious software without interacting with the operating system or hypervisor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If power consumption analysis is applied to detect malicious software in virtualized environments, then malware detection capability is improved, but the complexity of identifying which specific guest operating system is infected increases due to multiple overlapping power usage patterns from different applications and hypervisor activities
Solution Approach 1:
The patent segments the power consumption signal into individual guest operating system contributions using signal processing techniques. By treating each guest OS power signature as a separable component in a mixed signal, the system can isolate and identify malicious software in specific virtual machines despite the composite nature of total power consumption.
Solution Approach 2:
The patent introduces signal processing algorithms as an intermediary between raw power consumption measurements and malware detection. These algorithms act as a mediator that processes the complex mixed signal from multiple guest OSes and hypervisor activities, extracting individual signatures and enabling identification of infected systems without direct interaction with the virtualized environment.
2Measurement precision
If traditional malware detection software is installed on the system, then detection accuracy is improved, but system compatibility and ease of deployment deteriorate in closed-box or legacy systems where software installation is not possible
Solution Approach 1:
The patent replaces software-based malware detection with a physics-based measurement approach using power consumption analysis. By substituting the mechanical/software detection mechanism with an electrical measurement system that monitors power usage patterns, the solution achieves malware detection capability in systems where traditional software cannot be installed, including legacy and closed-box environments.
Solution Approach 2:
The power consumption measurement system serves as an intermediary detection mechanism that does not require interaction with the target system's software layer. This intermediary approach enables compromise detection in environments where direct software installation is prohibited, while maintaining detection accuracy through analysis of electrical power characteristics.
3Measurement precision
If detailed raw power consumption data is collected from all guest operating systems, then detection precision is improved, but data processing complexity and computational requirements increase significantly
Solution Approach 1:
The patent extracts only the essential signature features from the raw power consumption data of each guest operating system. By taking out and isolating the characteristic power signature patterns that identify specific applications and guest OSes, the system reduces the data volume requiring further processing while maintaining the precision needed for malware detection.
Solution Approach 2:
The patent segments the detailed raw power data into distinct guest OS contributions through signal processing. This segmentation separates the composite power signal into individual components, allowing the system to work with processed signature data rather than raw measurements, thereby reducing computational complexity while preserving detection precision.
Data Source
AI summary
A method and system for determining a power consumption pattern for at least one application being executed on a computer is provided. The method comprises measuring a DC current and measuring a DC supply voltage provided to a data processing device, thereby creating a stream of time-stamped voltage value samples and current value samples. The method comprises further determining a product of the streams at identical times and converting the product into a real and an imaginary data stream using I/Q digital signal processing, combining these into a complex data stream, applying a signal processing demodulation step to the complex data stream, thereby generating a demodulated data stream, and extracting from the demodulated data stream at least one stream-based parameter signature, the at least one stream-based parameter signature representing the power consumption pattern of the at least one corresponding application being executed on the data processing device.