Anomaly Detection Using Program Counter Histograms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data processing systems lack an efficient and accurate method to detect anomalies caused by malfunctions or attacks, which can compromise system integrity and security.
Innovation Solution
A method and system utilizing a program counter histogram and machine learning model, specifically a support vector machine algorithm, to detect anomalous program execution in processing cores by constructing histograms from program counter values and using them for training and real-time anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anomaly detection methods are used in data processing systems, then the system structure remains simple, but the detection accuracy and reliability are insufficient to identify anomalies caused by malfunctions or attacks
Solution Approach 1:
The system performs preliminary actions by collecting program counter values and constructing histograms during normal operation to establish a baseline of normal behavior. This historical data is stored and used for comparison during anomaly detection, enabling the system to identify deviations from normal execution patterns without requiring complex real-time analysis of all possible anomaly scenarios
Solution Approach 2:
The patent introduces histograms as an intermediary representation between raw program counter values and anomaly detection. The histogram aggregates execution frequency data into a compact form that captures normal program behavior patterns, serving as a mediator that simplifies the comparison process and improves detection accuracy without requiring direct analysis of individual instruction addresses
2Reliability
If no anomaly detection mechanism is implemented, then the system operates with high speed and low overhead, but the system security and reliability are compromised due to undetected anomalies
Solution Approach 1:
The patent replaces traditional mechanical or rule-based anomaly detection mechanisms with a data-driven histogram analysis approach. Instead of using complex real-time monitoring and analysis systems that would significantly impact performance, the system uses pre-collected execution frequency data stored in histograms to quickly identify anomalies by comparing current execution patterns against the established baseline
Solution Approach 2:
The system extracts only the essential information needed for anomaly detection by collecting program counter values and aggregating them into histograms. This extraction approach focuses on the most relevant execution pattern data while ignoring unnecessary details, enabling efficient anomaly detection with minimal impact on system performance
Data Source
AI summary
A data processing system and a method for detecting an anomaly in the data processing system are provided. The method includes receiving a plurality of program counter values from a processing core of the data processing system. Each of the plurality of program counter values corresponds to an instruction being executed in the data processing system. A histogram is constructed using the plurality of program counter values. The histogram is provided to a machine learning (ML) model and used for training the ML model. If training has already been accomplished, the histogram is provided during inference operation of the ML model. The ML model and the histogram are used to detect an anomaly in the data processing system. If an anomaly is detected, an indication of the anomaly may be provided.