公开(公告)号：US20190042746A1

公开(公告)日：2019-02-07

申请号：US16021411

申请日：2018-06-28

Applicant: Intel Corporation

Inventor： Alex Nayshtut ,  VADIM SUKHOMLINOV ,  KOICHI YAMADA ,  AJAY HARIKUMAR ,  VENKAT GOKULRANGAN

IPC: G06F21/56 ,  G06F21/55

Abstract: The disclosed embodiments generally relate to detecting malware through detection of micro-architectural changes (morphing events) when executing a code at a hardware level (e.g., CPU). An exemplary embodiment relates to a computer system having: a memory circuitry comprising an executable code; a central processing unit (CPU) in communication with the memory circuitry and configured to execute the code; a performance monitoring unit (PMU) associated with the CPU, the PMU configured to detect and count one or more morphing events associated with execution of the code and to determine if the counted number of morphine events exceed a threshold value; and a co-processor configured to initiate a memory scan of the memory circuitry to identify a malware in the code.