# US 12,216,759 B2 · Discrete processor feature behavior collection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,216,759 B2 - Document ID: US12216759B2 - Status: Granted - Kind: B2 - Application number: 18/512,603 - Filed: 2023-11-17 - Published: 2024-03-14 - Granted: 2025-02-04 - Earliest claimed: 2017-06-28 - Assignees: Open Text Corporation - Applicants: Open Text Inc. - Inventors: Eric Klonowski - Web page: https://patentgrep.com/patent/US12216759B2 ## CPC - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 21/554: {involving event detection and direct action} - G06F 11/3409: {for performance assessment} - G06F 11/3636: {by tracing the execution of the program} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 2201/865: Monitoring of software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Examples of the present disclosure describe systems and methods for discrete processor feature behavior collection and analysis. In aspects, a monitoring utility may initialize a set of debugging and/or performance monitoring feature sets for a microprocessor. When the microprocessor receives from software content a set of instructions that involves the loading of a set of modules or code segments, the set of modules or code segments may be evaluated by the monitoring utility. The monitoring utility may generate a process trace of the loaded set of modules or code segments. Based on the process trace output, various execution paths may be reconstructed in real-time. The system and/or API calls made by the microprocessor may then be compared to the process trace output to quickly observe the interaction between the software content and the operating system of the microprocessor. ## Claims ### Claim 1 A method, comprising: monitoring, by a monitor engine including a secure execution environment, interactions between software content and a computing environment, wherein the monitor engine executes in the computing environment and maintains a secure execution environment in a secure area of the computing environment such that the secure execution environment is inaccessible to any untrusted components or operations; detecting, by the monitor engine, storing of instructions into memory of the computing environment based on an address of a memory access; evaluating, by the monitor engine, instructions of the software content, wherein evaluating the instructions comprises evaluating the instructions to determine performance data associated with the software content using one or more profiling tools or models to evaluate at least one aspect of the instructions to determine the performance data; identifying, by the monitor engine using the secure execution environment, calls of interest in the instructions by classifying the calls of interest based on the performance data and evaluating the calls of interest to generate behavioral signatures; applying, by the monitor engine, behavioral signatures to determine that software content is malicious; and based on the determined malicious software content, taking a remedial action including isolating the software content. ### Claim 2 (depends on 1) The method of claim 1, wherein the computing environment comprises a local computing environment of a remote environment. ### Claim 3 (depends on 1) The method of claim 1, wherein the monitor engine is associated with an operating system kernel. ### Claim 4 (depends on 1) The method of claim 1, wherein the performance data includes on global or local variables, function names, entry point addresses, or line numbers. ### Claim 5 A system, comprising: a processor; a memory coupled to the processor, the memory comprising computer executable instructions for: monitoring, by a monitor engine including a secure execution environment, interactions between software content and a computing environment, wherein the monitor engine executes in the computing environment and maintains a secure execution environment in a secure area of the computing environment such that the secure execution environment is inaccessible to any untrusted components or operations; detecting, by the monitor engine, storing of instructions into memory of the computing environment based on an address of a memory access; evaluating, by the monitor engine, instructions of the software content, wherein evaluating the instructions comprises evaluating the instructions to determine performance data associated with the software content using one or more profiling tools or models to evaluate at least one aspect of the instructions to determine the performance data; identifying, by the monitor engine using the secure execution environment, calls of interest in the instructions by classifying the calls of interest based on the performance data and evaluating the calls of interest to generate behavioral signatures; applying, by the monitor engine, behavioral signatures to determine that software content is malicious; and based on the determined malicious software content, taking a remedial action including isolating the software content. ### Claim 6 (depends on 5) The system of claim 5, wherein the computing environment comprises a local computing environment of a remote environment. ### Claim 7 (depends on 5) The system of claim 5, wherein the monitor engine is associated with an operating system kernel. ### Claim 8 (depends on 5) The system of claim 5, wherein the performance data includes on global or local variables, function names, entry point addresses, or line numbers. ### Claim 9 A non-transitory computer readable medium, comprising instructions for: monitoring, by a monitor engine including a secure execution environment, interactions between software content and a computing environment, wherein the monitor engine executes in the computing environment and maintains a secure execution environment in a secure area of the computing environment such that the secure execution environment is inaccessible to any untrusted components or operations; detecting, by the monitor engine, storing of instructions into memory of the computing environment based on an address of a memory access; evaluating, by the monitor engine, instructions of the software content, wherein evaluating the instructions comprises evaluating the instructions to determine performance data associated with the software content using one or more profiling tools or models to evaluate at least one aspect of the instructions to determine the performance data; identifying, by the monitor engine using the secure execution environment, calls of interest in the instructions by classifying the calls of interest based on the performance data and evaluating the calls of interest to generate behavioral signatures; applying, by the monitor engine, behavioral signatures to determine that software content is malicious; and based on the determined malicious software content, taking a remedial action including isolating the software content. ### Claim 10 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the computing environment comprises a local computing environment of a remote environment. ### Claim 11 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the monitor engine is associated with an operating system kernel. ### Claim 12 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the performance data includes on global or local variables, function names, entry point addresses, or line numbers.