Methods and apparatus of anomalous memory access pattern detection for translational lookaside buffers

A method comprising:

• retrieving a first eviction data set from a translational lookaside buffer associated with a central processing unit;
• generating an anomaly detection model based upon at least one of a second eviction data set not including an anomaly and a third eviction data set including the anomaly;
• obtaining a notification of a process identifier of a process performing a priming of a first eviction set;
• determining that the process with the process identifier is the same process that reads pages corresponding to the first eviction set;
• performing machine learning analysis on event time series of the first eviction set to determine whether the anomaly is present in the first eviction data set based on the anomaly detection model;
• and
• at least one of modifying a bit value or terminating memory access operations when the anomaly is determined to be present.

A non-transitory computer readable medium comprising instructions that, when executed, cause a machine to at least:

• retrieve a first eviction data set from a translational lookaside buffer associated with a central processing unit;
• generate an anomaly detection model based upon at least one of a second eviction data set not including an anomaly and a third eviction data set including the anomaly;
• obtain a notification of a process identifier of a process performing a priming of a first eviction set;
• determine that the process with the process identifier is the same process that reads pages corresponding to the first eviction set;
• perform machine learning analysis on event time series of the first eviction set to determine whether the anomaly is present in the first eviction data set based on the anomaly detection model;
• and
• at least one of modify a bit value or terminate memory access operations when the anomaly is determined to be present.