Behavioral system-level detector that filters local alerts to generate system alerts with an increased confidence level

A system-level detector, comprising:

• a shared data structure for storing local alerts received over a period of time from at least one local detector that detects events resulting from execution of a corresponding processing unit, wherein each local alert comprises information of a respective event from the processing unit and a timing relationship for the respective event;
• and
• a system processing unit coupled to the shared data structure to receive the local alerts from the shared data structure and coupled to receive state information of each corresponding processing unit, the system processing unit having instructions to:
• receive local alerts from the shared data structure, order the local alerts according to the timing relationship for each respective event,
• filter the ordered local alerts to determine events indicating an undesirable behavior or attack,
• check a confidence score in the information of the respective event during the period of time for each local alert in the shared data structure,
• count a number of local alerts that have a confidence score above a threshold during the period of time, and
• determine that the number of local alerts are above the threshold in the period of time,
• responsive to the number of local alerts being above the threshold in the period of time, determine that the events indicate the undesirable behavior or the attack, and
• responsive to the determination that there are events indicating the undesirable behavior or the attack, generate a system alert.

A method, comprising:

• receiving local alerts from a local detector that detects processor-level events resulting from execution of a processing unit, wherein each local alert comprises information of a respective event of the events and a timing relationship for the respective event;
• receiving the local alerts into a shared data structure over a period of time;
• filtering the local alerts to determine events indicating an undesirable behavior or attack;
• and
• responsive to the determination that there are events indicating the undesirable behavior or the attack, generating a system alert,
• wherein the filtering of the local alerts comprises:
• checking a confidence score in the information of the respective event during the period of time for each local alert in the shared data structure;
• adding the confidence scores from each local alert in the shared data structure to obtain a total value of confidence scores;
• determining that the total value of confidence scores is above a threshold in the period of time;
• and
• responsive to the total value of confidence scores being above the threshold in the period of time, determining that the corresponding events indicate the undesirable behavior or the attack.