Run-time security protection system and method

A method of providing run-time security for vetting operation of device hardware, wherein a security protection system is coupled to the device hardware, wherein the security protection system includes a memory, a vetting system, a synchronization system, and a learning system, wherein a model of the device hardware is stored in the memory, wherein the model stores a plurality of vetted states based on a plurality of security signals of the device hardware, and wherein for each of the plurality of vetted states, the model stores a severity level value and at least one vetted next state, wherein said method comprises:

• comparing, by the vetting system, a real next state of the device hardware during operation with the at least one vetted next state of a vetted current state;
• providing, by the vetting system, an indication and a corresponding severity level when the real next state does not match any of the at least one vetted next state;
• performing synchronization, by the synchronization system, in response to said providing the indication by comparing each of at least one subsequent real next state of the device hardware with the plurality of vetted states until initial synchronization occurs when one of the at least one subsequent real next state matches one of the plurality of vetted states;
• and
• receiving, by the learning system, feedback from the device hardware in response to said providing the indication, and when indicated by the feedback, updating the model in accordance with the feedback.