公开(公告)号：US11429515B1

公开(公告)日：2022-08-30

申请号：US17319228

申请日：2021-05-13

Applicant: Arm Limited

Inventor： Michael Bartling ,  Hugo John Martin Vincent ,  Brendan James Moran

IPC: G06F11/36 ,  G06F21/78 ,  G06F21/53 ,  G06F21/60

Abstract: Techniques, supported by corresponding apparatuses and methods, are disclosed for monitoring execution of software in a trusted environment and generating path signatures which are characteristic of the behaviour of the software. Multiple approximate nearest neighbour searching hash tables are generated in dependence on such path signatures and on attribute information defining behavioural classifications for the path signatures. Later execution of the software in a non-trusted environment is monitoring and an observed path signature characteristic of the behaviour of the software is generated. This observed path signature is queried against the multiple approximate nearest neighbour searching hash tables and a behavioural classification is determined in dependence on hash collision-based similarity between the observed path signature and the content of the multiple approximate nearest neighbour searching hash tables.

公开(公告)号：US20240386093A1

公开(公告)日：2024-11-21

申请号：US18198625

申请日：2023-05-17

Applicant: Arm Limited

Inventor： Brendan James Moran ,  Michael Bartling

IPC: G06F21/54 ,  G06F21/53 ,  G06F21/55

Abstract: A computer implemented method is provided. The computer implemented method includes receiving, for execution by a processing element, a relocatable instrumented code block, the relocatable instrumented code block being code that has undergone instrumentation for a monitoring system, duplicating at least one function of the relocatable instrumented code block to produce a plurality of duplicate relocatable code blocks, allocating the instrumented code block and each duplicate relocatable code block of the plurality of duplicate relocatable code blocks to different locations in a memory on a computing device, creating a relocated mapping of the instrumented code block and each duplicate relocatable code block to their corresponding locations in the memory, and transmitting a copy of the mapping of the instrumented code block and each duplicate relocatable code block to their corresponding locations in memory to the monitoring system.

公开(公告)号：US12147805B2

公开(公告)日：2024-11-19

申请号：US18117186

申请日：2023-03-03

Applicant: Arm Limited

Inventor： Brendan James Moran ,  Michael Bartling

IPC: G06F9/30 ,  G06F9/38 ,  G06F11/34

Abstract: There is provided an apparatus and method, the apparatus comprising storage circuitry to store event information associated with instructions occurring between instrumentation points. The event information indicates a plurality of different types of events expected to occur during execution of the instructions. The event information comprises, for each event, type information indicating a type of that event and an expected number of occurrences of that event. The apparatus is also provided with monitoring circuitry comprising a plurality of programmable counters. The monitoring circuitry is responsive to a start instrumentation point, to assign at least a subset of the plurality of programmable counters to measure, during execution of the program instructions, occurrences of the plurality of different types of events identified in the event information. The monitoring circuitry is responsive to at least one counter deviating from the expected number of occurrences indicated by that counter, to perform a predetermined action.

公开(公告)号：US12147326B2

公开(公告)日：2024-11-19

申请号：US17887927

申请日：2022-08-15

Applicant: Arm Limited

Inventor： Brendan James Moran ,  Hugo John Martin Vincent ,  Michael Bartling

IPC: G06F11/34 ,  G06F18/21

Abstract: A behavioral sensor for creating consumable events can include: a feature extractor coupled to receive an event stream of events performed by a circuit, wherein the feature extractor identifies features of a particular event of the event stream and associates the particular event with a time; and a classifier coupled to receive the features of the particular event from the feature extractor, wherein the classifier classifies the particular event into a classified event associated with the time using predefined categories based on the received features of the particular event; whereby the classified event and subsequent classified events extracted from the event stream within a time frame are appended in a time series forming the consumable events.

公开(公告)号：US12079309B2

公开(公告)日：2024-09-03

申请号：US17559246

申请日：2021-12-22

Applicant: Arm Limited

Inventor： Michael Bartling

IPC: G06F17/00 ,  A61B5/145 ,  G06F11/34 ,  G06F17/18 ,  G06F18/21 ,  G06Q30/0202 ,  A61B5/02 ,  A61B5/24 ,  G06F16/906 ,  G06N20/00 ,  G06Q30/02 ,  G06V10/774

CPC classification number: G06F18/2193 ,  A61B5/14532 ,  G06F11/3409 ,  G06F11/3452 ,  G06F17/00 ,  G06F17/18 ,  G06Q30/0202

Abstract: A data processing apparatus is provided that includes forecast circuitry for generating a forecast of an aspect of a system for a next future time and for one or more subsequent future times following the next future time. Measurement circuitry generates, at the next future time, a new measurement of the aspect of the system. Aggregation circuitry produces an aggregation of the forecast of the aspect of the system for the next future time and of the new measurement of the aspect of the system. The forecast circuitry revises the forecast of the aspect of the system for the one or more subsequent future times using the aggregation.

公开(公告)号：US20240232351A9

公开(公告)日：2024-07-11

申请号：US17972986

申请日：2022-10-25

Applicant: Arm Limited

Inventor： Archie David Licudi ,  Michael Bartling

IPC: G06F21/56 ,  G06F9/54

CPC classification number: G06F21/566 ,  G06F9/542 ,  G06F2221/034

Abstract: A method and apparatus to classify processor events is provided. The apparatus includes a reference generator, a warping unit, a correlation unit and a detector. The reference generator provides a self-reference for an event vector stream based on a history of the event vector stream and the warping unit dynamically aligns the event vector stream with the self-reference to generate a warped event vector stream. The correlation unit determines a window-by-window correlation of event vectors of the warped event vector stream, and the detector passes a window of event vectors of the warped event vector stream to a behavioral classifier when the window-by-window correlation achieves a threshold value. The behavioral classifier may use machine learning. A sample reservoir may be used to store dynamically selected event vectors of the event vector stream that are used, at least in part, to generate the self-reference.