# US 11,308,202 B2 · Intrusion detection systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,202 B2 - Document ID: US11308202B2 - Status: Granted - Kind: B2 - Application number: 16/486,331 - Filed: 2018-06-07 - Published: 2020-03-19 - Granted: 2022-04-19 - Earliest claimed: 2017-06-07 - Assignees: Hewlett-Packard Development Company, L.P. - Applicants: Hewlett-Packard Development Company, L.P. - Inventors: Ronny Chevalier; David Plaquin; Maugan Villatel; Guillaume Hiet - Web page: https://patentgrep.com/patent/US11308202B2 ## CPC - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 9/544: {Buffers; Shared memory; Pipes} - G06F 9/546: {Message passing systems or structures, e.g. queues} - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2221/2105: Dual mode as a secondary aspect - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An intrusion detection system, comprising a monitor to receive messages from a target over a low-latency communication link comprising a controlled access memory structure logically positioned between the target and the monitor using point-to-point interconnects, the controlled access memory structure to receive a message from the target indicating that the target has entered a controlled mode of operation. ## Claims ### Claim 1 An intrusion detection system, comprising: a monitor to receive messages from a target over a communication link comprising a controlled access memory structure logically positioned between the target and the monitor using a point-to-point interconnect, the controlled access memory structure to store the messages including a message from the target indicating that the target has entered a System Management Mode (SMM) that is a privileged execution mode of a central processing unit (CPU), the monitor to compare the messages retrieved from the controlled access memory structure to information of an expected behavior of the target, for detecting a deviation from the expected behavior that is indicative of an intrusion. ### Claim 2 (depends on 1) The intrusion detection system of claim 1, wherein the controlled access memory structure comprises a linear or circular array in which the messages are processed in an order in which the messages are received. ### Claim 3 (depends on 1) The intrusion detection system of claim 1, wherein a physical address of the target is mapped to the monitor. ### Claim 4 (depends on 1) The intrusion detection system of claim 1, wherein the monitor has exclusive access to the communication link while the target is executing. ### Claim 5 (depends on 1) The intrusion detection system of claim 1, wherein the monitor comprises a virtual machine instantiated over physical hardware allocated in a virtualized system using a hypervisor. ### Claim 6 (depends on 5) The intrusion detection system of claim 5, wherein the monitor comprises the hypervisor. ### Claim 7 (depends on 1) The intrusion detection system of claim 1, wherein the controlled access memory structure is provided as part of the target or the monitor or as a standalone component. ### Claim 8 An intrusion detection system comprising a communication link between a target and a monitor, the communication link comprising a controlled access memory structure logically positioned between the target and the monitor using a point-to- point interconnect, the controlled access memory structure to receive a message from the target indicating that the target has entered a System Management Mode (SMM) of operation that is a privileged execution mode of a central processing unit (CPU). ### Claim 9 (depends on 8) The intrusion detection system of claim 8, wherein the target comprises a mapping from a physical address of the target to the monitor. ### Claim 10 (depends on 8) The intrusion detection system of claim 8, further comprising the monitor that has exclusive access to the communication link while the target is executing. ### Claim 11 A monitor in an intrusion detection system, the monitor to: receive messages from a monitored component over a low-latency communication link comprising a controlled access memory structure logically positioned between the monitored component and the monitor using a point-to-point interconnect, the controlled access memory structure to receive messages from the monitored component, the messages including a message indicating that the monitored component has entered a System Management Mode (SMM) that is a privileged execution mode of a central processing unit (CPU); and compare the messages retrieved from the controlled access memory structure to information of an expected behavior of the monitored component, for detecting a deviation from the expected behavior that is indicative of an intrusion. ### Claim 12 (depends on 11) The monitor of claim 11, wherein the controlled access memory structure comprises a linear or circular array in which the messages received from the monitored component are processed in an order in which the messages are received. ### Claim 13 (depends on 11) The monitor of claim 11, wherein the controlled access memory structure comprises a mapping to a physical address of the monitored component. ### Claim 14 (depends on 11) The monitor of claim 11, wherein the monitor is a virtual machine instantiated over physical hardware allocated in a virtualized system using a hypervi sor. ### Claim 15 (depends on 14) The monitor of claim 14, wherein the virtual machine comprises a secure execution environment inaccessible to other components of the virtualized system. ### Claim 16 A non-transitory machine-readable storage medium encoded with instructions executable by a processor of a monitor to: receive first messages from a monitored component over a low-latency communication link comprising a controlled access memory structure logically positioned between the monitored component and the monitor using a point-to-point interconnect; and receive a message from the monitored component indicating that the monitored component has entered a System Management Mode (SMM) that is a privileged execution mode of a central processing unit (CPU). ### Claim 17 (depends on 16) The non-transitory machine-readable storage medium of claim 16, wherein the instructions are executable by the processor of the monitor to: compare the first messages retrieved from the controlled access memory structure to information of an expected behavior of the monitored component, for detecting a deviation from the expected behavior that is indicative of an intrusion.