Anomaly and malware detection using side channel analysis
AssigneeVirta Laboratories, Inc.
InventorsDenis Foo Kune, Benjamin Andrew Ransford, Daniel Edward Holcomb
Life of this patent
Estimating the term…
Abstract
The present disclosure describes systems and methods for detecting malware. More particularly, the system includes a monitoring device that monitors side-channel activity of a target device. The monitoring device that can work in conjunction with (or independently of) a cloud-based security analytics engine to perform anomaly detection and classification on the side-channel activity. For example, the monitoring device can calculate a first set of features that are then transmitted to the security analytics engine for anomaly detection and classification.
Claims20
A method for anomaly detection comprising:
- receiving, by one or more data processors, an input signal comprising a plurality of samples, each of the plurality of samples representing a power consumption level of a target device at a given time;
- storing, by the one or more data processors, the plurality of samples as a data structure in a memory element coupled to the one or more data processors;
- retrieving, by the one or more data processors, a subset of the plurality of samples from the data structure;
- calculating, by the one or more data processors, a feature sample for the subset of the plurality of samples;
- transmitting, by the one or more data processors and to a remote server, the feature sample;
- receiving, by the one or more data processors and from the remote server, a classification of the feature sample;
- and
- generating, by the one or more data processors, an alarm signal responsive to the classification of the feature sample indicating an anomaly.
A monitoring device comprising:
- a pass-through power circuit comprising an inlet and an outlet;
- a current sensor configured to generate a signal corresponding to an amount of current flowing through the pass-through power circuit;
- and
- one or more data processors configured to:
- convert the signal into a plurality of samples representing a level of current flowing into a target device at a given time;
- store the plurality of samples as a data structure in a memory element coupled to the one or more data processors;
- retrieve a subset of the plurality of samples from the data structure stored in the memory element;
- calculate a feature sample of the subset of the plurality of samples;
- transmit the feature sample to a remote server;
- receive from the remote server a classification of the feature sample;
- and
- generate, responsive to receiving a feature classification indicating an anomaly, an alarm signal.
A computer readable medium storing processor executable instructions thereon, the instructions, when executed by one or more data processors, cause the one or more data processors to:
- receive an input signal comprising a plurality of samples, each of the plurality of samples representing a power consumption level of a target device at a given time;
- store the plurality of samples as a data structure in a memory element coupled to the one or more data processors;
- retrieve a subset of the plurality of samples from the data structure;
- calculate a feature sample for the subset of the plurality of samples;
- transmit the feature sample;
- receive a classification of the feature sample;
- and
- generate an alarm signal responsive to the classification of the feature sample indicating an anomaly.
Dependencies are inferred from the claim text.