RANSOMWARE DETECTION IN MEMORY OF A DATA PROCESSING UNIT USING MACHINE LEARNING DETECTION MODELS

    公开(公告)号:US20240427890A1

    公开(公告)日:2024-12-26

    申请号:US18824197

    申请日:2024-09-04

    Abstract: Apparatuses, systems, and techniques for classifying one or more computer programs executed by a host device as being ransomware using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service obtains a series of snapshots of data stored in the physical memory and extracts a set of features from each snapshot of the series of snapshots, each snapshot representing the data at a point in time. The security service classifies a process of the one or more computer programs as ransomware or non-ransomware using the set of features and outputs an indication of ransomware responsive to the process being classified as ransomware.

    Preserving confidentiality of tenants in cloud environment when deploying security services

    公开(公告)号:US12032680B2

    公开(公告)日:2024-07-09

    申请号:US17709815

    申请日:2022-03-31

    CPC classification number: G06F21/53 G06F21/606 G06F2221/033

    Abstract: The technology disclosed herein enables an auxiliary device to run a service that can access and analyze data of a Trusted Execution Environment (TEE). The auxiliary device may establish an auxiliary TEE in the auxiliary device and establish a trusted communication link between the auxiliary TEE and the TEE (i.e., primary TEE). The primary TEE may execute a target program using the primary devices of a host device (e.g., CPU) and the auxiliary TEE may execute a security program using the auxiliary device (e.g., DPU). In one example, the primary and auxiliary TEEs may be established for a cloud consumer and the auxiliary TEE may execute a security service that can monitor data of the primary TEE even though the data is inaccessible to all other software executing external to the primary TEE (e.g., inaccessible to host operating system and hypervisor).

    PRESERVING CONFIDENTIALITY OF TENANTS IN CLOUD ENVIRONMENT WHEN DEPLOYING SECURITY SERVICES

    公开(公告)号:US20230297666A1

    公开(公告)日:2023-09-21

    申请号:US17709815

    申请日:2022-03-31

    CPC classification number: G06F21/53 G06F21/606 G06F2221/033

    Abstract: The technology disclosed herein enables an auxiliary device to run a service that can access and analyze data of a Trusted Execution Environment (TEE). The auxiliary device may establish an auxiliary TEE in the auxiliary device and establish a trusted communication link between the auxiliary TEE and the TEE (i.e., primary TEE). The primary TEE may execute a target program using the primary devices of a host device (e.g., CPU) and the auxiliary TEE may execute a security program using the auxiliary device (e.g., DPU). In one example, the primary and auxiliary TEEs may be established for a cloud consumer and the auxiliary TEE may execute a security service that can monitor data of the primary TEE even though the data is inaccessible to all other software executing external to the primary TEE (e.g., inaccessible to host operating system and hypervisor).

    MALICIOUS ACTIVITY DETECTION IN MEMORY OF A DATA PROCESSING UNIT USING MACHINE LEARNING DETECTION MODELS

    公开(公告)号:US20230259614A1

    公开(公告)日:2023-08-17

    申请号:US17864306

    申请日:2022-07-13

    CPC classification number: G06F21/552 G06F2221/034

    Abstract: Apparatuses, systems, and techniques for detecting that one or more computer programs executed by a host device are subject to malicious activity using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being associated with the one or more computer programs. The security service determines, using the ML detection system, whether the one or more computer programs are subject to malicious activity based on the set of features. The security service outputs an indication of the malicious activity responsive to a determination that the one or more computer programs are subject to the malicious activity.

Patent Agency Ranking