Systems and Methods to Fingerprint and Classify Application Behaviors Using Telemetry

A non-transitory computer readable storage medium comprising computer readable instructions that, when executed, cause at least one processor to at least:

• process events in a processor trace to capture application execution behavior corresponding to processor control flow associated with the events;
• extract a first fingerprint from the captured application execution behavior and performance monitor information;
• in a training mode, when the first fingerprint and a second fingerprint are determined to be within a similarity threshold based on a distance metric, cluster the first fingerprint and the second fingerprint to form a cluster of fingerprints to be stored in a fingerprint database with a classification;
• in a deployed mode, classify a third fingerprint, the third fingerprint to be classified with the classification associated with the cluster of fingerprints when a comparison of the third fingerprint to the cluster of fingerprints from the fingerprint database using the distance metric is within the similarity threshold;
• and
• trigger a remedial action when the classification is malicious.

A method comprising:

• processing, by executing an instruction with at least one processor, events for an application in a processor trace to capture application execution behavior corresponding to processor control flow associated with the events;
• extracting, by executing an instruction with the at least one processor, a first fingerprint from the captured application execution behavior and performance monitor information;
• in a training mode, when the first fingerprint and a second fingerprint are determined to be within a similarity threshold based on a distance metric, clustering, by executing an instruction with the at least one processor, the first fingerprint and the second fingerprint to form a cluster of fingerprints to be stored in a fingerprint database with a classification;
• in a deployed mode, classifying, by executing an instruction with the at least one processor, a third fingerprint, the third fingerprint to be classified with the classification associated with the cluster of fingerprints when a comparison of the third fingerprint to the cluster of fingerprints from the fingerprint database using the distance metric is within the similarity threshold;
• and
• triggering, by executing an instruction with the at least one processor, a remedial action when the classification is malicious.

An apparatus comprising:

• memory including machine reachable instructions;
• and
• at least one processor to execute the instructions to:
• process events for an application in a processor trace to capture application execution behavior corresponding to processor control flow associated with the events;
• extract a first fingerprint from the captured application execution behavior and performance monitor information;
• in a training mode, when the first fingerprint and a second fingerprint are determined to be within a similarity threshold based on a distance metric, cluster the first fingerprint and the second fingerprint to be stored in a fingerprint database with a classification;
• in a deployed mode, classify a third fingerprint, the third fingerprint to be classified with the classification associated with the cluster of fingerprints when a comparison of the third fingerprint to the cluster of fingerprints from the fingerprint database using the distance metric is within the similarity threshold;
• and
• trigger a remedial action when the classification is malicious.