Detecting timing anomalies
AssigneeThe MITRE Corporation
InventorsDarrow Paine Leibner, Alessandro Paolo Cerruti
Life of this patent
Estimating the term…
Abstract
Disclosed herein are system, method, and computer program product embodiments for adapting to malware activity on a compromised computer system by detecting timing anomalies between timing signals. An embodiment operates by analyzing first timing data accessed from a validated source and second timing data accessed from an unvalidated receiver source in order to compute a threat detection value, which is utilized to determine if there is a discrepancy or anomaly in the timing or frequency of either the validated and unvalidated sources.
Claims20
A timing analysis detection system, comprising:
- an independent clock source;
- a GPS receiver;
- and
- a timing error measuring unit configured to:
- process first timing data accessed from the independent clock source;
- process second timing data accessed from the GPS receiver;
- analyze the processed first timing data and the processed second timing data for an adjustable interval of time to determine a threat detection value, wherein to analyze, the timing error measurement unit is further configured to:
- receive, from the GPS receiver, a pulse per second timing signal;
- receive, from the independent clock source, timing pulses;
- and
- initiate a cycle counter to track a number of the timing pulses during the adjustable interval of time;
- and
- determine the threat detection value based on comparing the number of the timing pulses to a predetermined expected number of cycles.
A method comprising:
- processing first timing data accessed from an independent clock source;
- processing second timing data accessed from a GPS receiver;
- analyzing the processed first timing data and the processed second timing data for an adjustable interval of time to determine a threat detection value, wherein the analyzing comprises:
- receiving, from the GPS receiver, a pulse per second timing signal;
- receiving, from the independent clock source, timing pulses;
- and
- initiating a cycle counter to track a number of the timing pulses during the adjustable interval of time;
- and
- determining the threat detection value based on comparing the number of the timing pulses to a predetermined expected number of cycles.
A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
- processing first timing data accessed from an independent clock source;
- processing second timing data accessed from a GPS receiver;
- analyzing the processed first timing data and the processed second timing data for an adjustable interval of time to determine a threat detection value, wherein the analyzing comprises:
- receiving, from the GPS receiver, a pulse per second timing signal;
- receiving, from the independent clock source, timing pulses;
- and
- initiating a cycle counter to track a number of the timing pulses during the adjustable interval of time;
- and
- determining the threat detection value based on comparing the number of the timing pulses to a predetermined expected number of cycles.
Dependencies are inferred from the claim text.