Systems and methods for detecting potentially malicious hardware-related anomalies

A system for detecting potentially malicious hardware-related anomalies, the system comprising:

• a profiling module, stored in memory, that profiles a current computing environment of at least one hardware component on a computing device;
• a detection module, stored in memory, that detects, by comparing the hardware component's profile with an expected profile for the hardware component, at least one anomaly in the hardware component's current computing environment;
• an identification module, stored in memory, that identifies additional suspicious activity on the computing device that:
• potentially constitutes abnormal operation of the computing device;
• and
• does not constitute an anomaly in the hardware component's computing environment;
• a determination module, stored in memory, that determines, by correlating the additional suspicious activity on the computing device with the anomaly in the hardware component's current computing environment, that the anomaly in the hardware component's current computing environment is potentially malicious, wherein correlating the additional suspicious activity on the computing device with the anomaly in the hardware component's current computing environment comprises identifying at least one firmware-related attribute in common between the additional suspicious activity and the anomaly that suggests the anomaly is a cause of the additional suspicious activity;
• a performance module, stored in memory, that, upon determining that the anomaly in the hardware component's current computing environment is potentially malicious, performs a security action that remediates the potentially malicious anomaly in the current computing environment of the hardware component and thereby improves a state of security of the computing device;
• and
• at least one processor that executes the profiling module, the detection module, the identification module, the determination module, and the performance module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• profile a current computing environment of at least one hardware component on the computing device;
• detect, by comparing the hardware component's profile with an expected profile for the hardware component, at least one anomaly in the hardware component's current computing environment;
• identify additional suspicious activity on the computing device that:
• potentially constitutes abnormal operation of the computing device;
• and
• does not constitute an anomaly in the hardware component's computing environment;
• determine, by correlating the additional suspicious activity on the computing device with the anomaly in the hardware component's current computing environment, that the anomaly in the hardware component's current computing environment is potentially malicious, wherein correlating the additional suspicious activity on the computing device with the anomaly in the hardware component's current computing environment comprises identifying at least one firmware-related attribute in common between the additional suspicious activity and the anomaly that suggests the anomaly is a cause of the additional suspicious activity;
• and
• upon determining that the anomaly in the hardware component's current computing environment is potentially malicious, performing a security action that remediates the potentially malicious anomaly in the current computing environment of the hardware component and thereby improves a state of security of the computing device.