Detecting a compromised system using an integrated management controller

An apparatus comprising a computing device, a computer processor, and a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:

• receiving a workload characterization for an expected hardware utilization of a computing system, wherein the workload characterization is a pattern of expected hardware utilization of computing hardware on the computing system, and wherein the workload characterization comprises hardware utilization thresholds;
• storing the workload characterization on an integrated management controller communicatively coupled to the computing hardware on the computing system;
• monitoring the computing hardware of the computing system using the integrated management controller, including comparing the hardware utilization thresholds of the workload characterization to measured hardware utilization of the computing hardware, wherein the measured hardware utilization of the computing hardware is retrieved by the integrated management controller;
• determining that the computing system is compromised based on detecting that the measured hardware utilization of the computing hardware has exceeded one of the hardware utilization thresholds of the workload characterization;
• and
• performing a notification action in response to determining that the computing system is compromised.

A computer program product including a computer readable medium, the computer program product comprising computer program instructions that, when executed, cause a computer to carry out the steps of:

• receiving a workload characterization for an expected hardware utilization of a computing system, wherein the workload characterization is a pattern of expected hardware utilization of computing hardware on the computing system, and wherein the workload characterization comprises hardware utilization thresholds;
• storing the workload characterization on an integrated management controller communicatively coupled to the computing hardware on the computing system;
• monitoring the computing hardware of the computing system using the integrated management controller, including comparing the hardware utilization thresholds of the workload characterization to measured hardware utilization of the computing hardware, wherein the measured hardware utilization of the computing hardware is retrieved by the integrated management controller;
• determining that the computing system is compromised based on detecting that the measured hardware utilization of the computing hardware has exceeded one of the hardware utilization thresholds of the workload characterization;
• and
• performing a notification action in response to determining that the computing system is compromised.