Back to results
US 12,118,088 B2Granted
Moderator system for a security analytics framework
AssigneeArm Limited
InventorsSubbayya Chowdary Yanamadala, Jeremy Patrick Dubeuf, Carl Wayne Vineyard, Matthias Lothar Boettcher, Hugo John Martin Vincent, Shidhartha Das
Life of this patent
Estimating the term…
Abstract
A moderator system that can receive outputs of various stages of the security analytic framework and can receive input from external sources to provide information about emerging styles of attacks. One or more models/behavioral profiles can be curated by the moderator system, and the moderator system can provide updates to components of the security analytics framework.
Claims18
A method to provide moderation to a security analytics framework for a chip or particular integrated circuit (IC), the method comprising:
- sending a first model to a risk predictor of the security analytics framework for the chip or particular IC, wherein the first model includes context information for a particular application of the chip or particular IC;
- receiving operational data of the chip or particular IC;
- performing training on one or more stored models including the first model using the received operational data to generate at least a second model;
- sending the second model to at least the risk predictor;
- determining whether to make an adjustment to a current security configuration of the security analytics framework for the chip or particular IC based on at least the received operational data, wherein the current security configuration comprises a first configuration of one or more elements of interest of a plurality of elements of interest on the chip or particular IC that a data scavenger of the security analytics framework captures, wherein the one or more elements of interest are selectively collected according to the first configuration, and wherein the plurality of elements of interest on the chip or particular IC includes an element of interest captured from a performance counter;
- determining a particular security configuration for the security analytics framework for the chip or particular IC based on at least the received operational data;
- and
- sending the particular security configuration to at least one component of the security analytics framework for the chip or particular IC, wherein the at least one component comprises the data scavenger, wherein the particular security configuration updates the first configuration to a second configuration of elements of interest of the plurality of elements of interest on the chip or particular IC that the data scavenger captures to provide updated operational data of the chip or particular IC, wherein the elements of interest that are selectively collected is changed in the second configuration according to an updated configuration signal from the particular security configuration.
5 more elements
A moderator system to moderate a security analytics framework for a chip or particular integrated circuit (IC), the moderator system comprising:
- a moderator controller;
- an interface for communicating with components of the security analytics framework, the components of the security analytics framework comprising a data scavenger, a data analyzer;
- and
- a risk predictor;
- and
- a data resource storing one or more models of particular operations of the chip or particular IC;
- wherein the moderator controller comprises one or more processors and a local storage having instructions stored thereon that when executed direct the moderator system to:
- send, via the interface, a first model to the risk predictor, wherein the first model includes context information for a particular application of the chip or particular IC;
- receive, via the interface, operational data of the chip or particular IC;
- perform training on the one or more stored models including the first model using the received operational data to generate at least a second model;
- send, via the interface, the second model to at least the risk predictor;
- determine, whether to make an adjustment to a current security configuration of the security analytics framework for the chip or particular IC based on at least the received operational data, wherein the current security configuration comprises a first configuration of one or more elements of interest of a plurality of elements of interest on the chip or particular IC that the data scavenger captures, wherein the one or more elements of interest are selectively collected according to the first configuration, and wherein the plurality of elements of interest on the chip or particular IC includes an element of interest captured from a performance counter;
- determine a particular security configuration for the security analytics framework for the chip or particular IC based on at least the received operational data;
- and
- send, via the interface, the particular security configuration to at least one component of the components of the security analytics framework, wherein the at least one component comprises the data scavenger, wherein the particular security configuration updates the first configuration to a second configuration of elements of interest of the plurality of elements of interest on the chip or particular IC that the data scavenger captures to provide updated operational data of the chip or particular IC wherein the elements of interest that are selectively collected is changed in the second configuration according to an updated configuration signal from the particular security configuration.
12 more elements
Dependencies are inferred from the claim text.