Intrusion detection systems

An intrusion detection system comprising a communication link between a target and a monitor, the communication link comprising a controlled access memory structure logically positioned between the target and the monitor using a point-to- point interconnect, the controlled access memory structure to receive a message from the target indicating that the target has entered a System Management Mode (SMM) of operation that is a privileged execution mode of a central processing unit (CPU).

A monitor in an intrusion detection system, the monitor to:

• receive messages from a monitored component over a low-latency communication link comprising a controlled access memory structure logically positioned between the monitored component and the monitor using a point-to-point interconnect, the controlled access memory structure to receive messages from the monitored component, the messages including a message indicating that the monitored component has entered a System Management Mode (SMM) that is a privileged execution mode of a central processing unit (CPU);
• and
• compare the messages retrieved from the controlled access memory structure to information of an expected behavior of the monitored component, for detecting a deviation from the expected behavior that is indicative of an intrusion.

A non-transitory machine-readable storage medium encoded with instructions executable by a processor of a monitor to:

• receive first messages from a monitored component over a low-latency communication link comprising a controlled access memory structure logically positioned between the monitored component and the monitor using a point-to-point interconnect;
• and
• receive a message from the monitored component indicating that the monitored component has entered a System Management Mode (SMM) that is a privileged execution mode of a central processing unit (CPU).