Ransomware detection in memory of a data processing unit using machine learning detection models

An integrated circuit comprising:

• a host interface operatively coupled to physical memory associated with a host device;
• a central processing unit (CPU) operatively coupled to the host interface;
• and
• an acceleration hardware engine operatively coupled to the host interface and the CPU, wherein the CPU and the acceleration hardware engine are to host a hardware-accelerated security service to protect the host device, wherein the hardware-accelerated security service is to:
• obtain a series of snapshots of data stored in the physical memory of the host device, the data being associated with one or more computer programs executed by the host device, wherein the series of snapshots of data are obtained by the hardware-accelerated security service using out-of-band memory acquisitions isolated from the one or more computer programs;
• extract, using a machine learning (ML) detection system, a set of features from each snapshot of the series of snapshots, each snapshot representing the data at a point in time;
• classify, using the set of features and the ML detection system, a process of the one or more computer programs as ransomware or non-ransomware;
• and
• output an indication of ransomware responsive to the process being classified as ransomware.

A computing system comprising:

• a data processing unit (DPU) comprising a host interface, a central processing unit (CPU), and an acceleration hardware engine, the DPU to host a hardware-accelerated security service to protect a host device, wherein the hardware-accelerated security service is to extract a plurality of features from data stored in physical memory associated with the host device, the data being associated with one or more computer programs executed by the host device;
• and
• accelerated pipeline hardware coupled to the DPU, wherein the accelerated pipeline hardware is to:
• obtain a series of snapshots of data stored in the physical memory of the host device, the data being associated with the one or more computer programs, wherein the series of snapshots of data are obtained by the accelerated pipeline hardware using out-of-band memory acquisitions isolated from the one or more computer programs;
• extract, using a machine learning (ML) detection system, a set of features from each snapshot of the series of snapshots, each snapshot representing the data at a point in time;
• classify, using the set of features and the ML detection system, a process of the one or more computer programs as ransomware or non-ransomware;
• and
• output an indication of ransomware responsive to the process being classified as ransomware.