System, apparatus and method for detecting a data-oriented programming attack

A method comprising:

• executing, on at least one computer system, a program with a plurality of workloads;
• monitoring the program execution with the plurality of workloads to obtain information regarding a plurality of control transfers incurred during the execution of the program with the plurality of workloads;
• generating a time series of a plurality of control flow graphs of at least a portion of the execution of the program with the plurality of workloads based on the information;
• calculating a time series of a plurality of graph statistics based on the time series of the plurality of control flow graphs;
• storing the time series of the plurality of graph statistics in a storage;
• and
• after executing the program with the plurality of workloads, generating a statistical model for the program, the statistical model including a plurality of feature vectors based on the plurality of graph statistics comprising a first feature vector formed based on combining a first collection of the time series of the plurality of graph statistics, the first collection of the time series of the plurality of graph statistics associated with a first phase of the execution of the program.

An apparatus comprising:

• a processor comprising:
• at least one core comprising an execution circuit to execute a program;
• and
• at least one accelerator coupled to the at least one core, the at least one accelerator comprising one or more of a monitor circuit, a graph generation circuit, a statistic generation circuit and a comparison circuit;
• the monitor circuit to monitor the execution of the program to obtain information regarding a plurality of control transfers incurred during the execution of the program;
• the graph generation circuit, based on the information, to generate a plurality of control flow graphs each associated with a portion of the execution of the program;
• the statistic generation circuit to calculate a plurality of feature vectors each associated with one of the plurality of control flow graphs, wherein each of the plurality of feature vectors includes a plurality of graph statistics based on the associated control flow graph;
• and
• the comparison circuit to compare at least some of the plurality of graph statistics of one or more of the plurality of feature vectors to corresponding graph statistics of a statistical model of the execution of the program, to identify whether an anomaly has occurred in the execution of the program.