# US 2019/0319977 A1 · Systems and Methods to Fingerprint and Classify Application Behaviors Using Telemetry > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319977 A1 - Document ID: US20190319977A1 - Status: Published application - Kind: A1 - Application number: 16/455,189 - Filed: 2019-06-27 - Published: 2019-10-17 - Earliest claimed: 2019-06-27 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Justin Gottschlich; Rachit Mathur; Zheng Zhang - Web page: https://patentgrep.com/patent/US20190319977A1 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Apparatus, systems, methods, and articles of manufacture for fingerprinting and classifying application behaviors using telemetry are disclosed. An example apparatus includes a trace processor to process events in a processor trace to capture application execution behavior; a fingerprint extractor to extract a first fingerprint from the captured application execution behavior and performance monitor information; a fingerprint clusterer to, in a training mode cluster the first fingerprint and the second fingerprint into a cluster of fingerprints to be stored in a fingerprint database with a classification; and a fingerprint classifier to, in a deployed mode, classify a third fingerprint, the fingerprint classifier to trigger a remedial action when the classification is malicious. ## Claims ### Claim 1 An apparatus comprising: a trace processor to process events in a processor trace to capture application execution behavior corresponding to processor control flow associated with the events; a fingerprint extractor to extract a first fingerprint from the captured application execution behavior and performance monitor information; a fingerprint clusterer to, in a training mode, when the first fingerprint and a second fingerprint are compared and determined to be within a similarity threshold based on a distance metric, cluster the first fingerprint and the second fingerprint into a cluster of fingerprints to be stored in a fingerprint database with a classification; and a fingerprint classifier to, in a deployed mode, classify a third fingerprint, the fingerprint classifier to classify the third fingerprint with the classification associated with the cluster of fingerprints when a comparison of the third fingerprint to the cluster of fingerprints from the fingerprint database using the distance metric is within the similarity threshold, the fingerprint classifier to trigger a remedial action when the classification is malicious. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the captured application execution behavior includes i) target address information including points of control transfer within the application's address space, and ii) application programming interface (API) call sequences. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the captured application execution behavior further includes at least one of dynamic linked library execution, just in time code execution, or shell code execution. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the performance monitor information includes performance monitor unit counter values. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the fingerprint extractor is to calculate a first histogram of the captured application execution behavior and a second histogram of the performance monitor information and form the first fingerprint from the first histogram and the second histogram. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the distance metric includes at least one of a Jaccard distance, a Hamming distance, a Euclidean distance, or a Cosine similarity. ### Claim 7 (depends on 1) The apparatus of claim 1, further including a telemetry analyzer to gather crowd telemetry from a plurality of systems to verify or change the classification. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the telemetry analyzer is to update the fingerprint database based on a change in the classification. ### Claim 9 A non-transitory computer readable storage medium comprising computer readable instructions that, when executed, cause at least one processor to at least: process events in a processor trace to capture application execution behavior corresponding to processor control flow associated with the events; extract a first fingerprint from the captured application execution behavior and performance monitor information; in a training mode, when the first fingerprint and a second fingerprint are determined to be within a similarity threshold based on a distance metric, cluster the first fingerprint and the second fingerprint to form a cluster of fingerprints to be stored in a fingerprint database with a classification; in a deployed mode, classify a third fingerprint, the third fingerprint to be classified with the classification associated with the cluster of fingerprints when a comparison of the third fingerprint to the cluster of fingerprints from the fingerprint database using the distance metric is within the similarity threshold; and trigger a remedial action when the classification is malicious. ### Claim 10 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the instructions, when executed, cause the at least one processor to capture application execution behavior including i) target address information including points of control transfer within the application's address space, and ii) application programming interface (API) call sequences. ### Claim 11 (depends on 10) The non-transitory computer readable storage medium of claim 10, wherein the instructions, when executed, cause the at least one processor to capture application execution behavior including at least one of dynamic linked library execution, just in time code execution, or shell code execution. ### Claim 12 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the performance monitor information includes performance monitor unit counter values. ### Claim 13 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the instructions, when executed, cause the at least one processor to calculate a first histogram of the captured application execution behavior and a second histogram of the performance monitor information and form the first fingerprint from the first histogram and the second histogram. ### Claim 14 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the distance metric includes at least one of a Jaccard distance, a Hamming distance, a Euclidean distance, or a Cosine similarity. ### Claim 15 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the instructions, when executed, cause the at least one processor to gather crowd telemetry from a plurality of systems to verify or change the classification. ### Claim 16 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the instructions, when executed, cause the at least one processor to update the fingerprint database based on a change in the classification. ### Claim 17 A method comprising: processing, by executing an instruction with at least one processor, events for an application in a processor trace to capture application execution behavior corresponding to processor control flow associated with the events; extracting, by executing an instruction with the at least one processor, a first fingerprint from the captured application execution behavior and performance monitor information; in a training mode, when the first fingerprint and a second fingerprint are determined to be within a similarity threshold based on a distance metric, clustering, by executing an instruction with the at least one processor, the first fingerprint and the second fingerprint to form a cluster of fingerprints to be stored in a fingerprint database with a classification; in a deployed mode, classifying, by executing an instruction with the at least one processor, a third fingerprint, the third fingerprint to be classified with the classification associated with the cluster of fingerprints when a comparison of the third fingerprint to the cluster of fingerprints from the fingerprint database using the distance metric is within the similarity threshold; and triggering, by executing an instruction with the at least one processor, a remedial action when the classification is malicious. ### Claim 18 (depends on 17) The method of claim 17, further including capturing application execution behavior including i) target address information including points of control transfer within the application's address space, and ii) application programming interface (API) call sequences. ### Claim 19 (depends on 18) The method of claim 18, further including capturing application execution behavior including at least one of dynamic linked library execution, just in time code execution, or shell code execution. ### Claim 20 (depends on 17) The method of claim 17, wherein the performance monitor information includes performance monitor unit counter values. ### Claim 21 (depends on 17) The method of claim 17, further including calculating a first histogram of the captured application execution behavior and a second histogram of the performance monitor information and forming the first fingerprint from the first histogram and the second histogram. ### Claim 22 (depends on 17) The method of claim 17, wherein the distance metric includes at least one of a Jaccard distance, a Hamming distance, a Euclidean distance, or a Cosine similarity. ### Claim 23 (depends on 17) The method of claim 17, further including gathering crowd telemetry from a plurality of systems to verify or change the classification. ### Claim 24 (depends on 23) The method of claim 23, further including updating the fingerprint database based on a change in the classification. ### Claim 25 An apparatus comprising: memory including machine reachable instructions; and at least one processor to execute the instructions to: process events for an application in a processor trace to capture application execution behavior corresponding to processor control flow associated with the events; extract a first fingerprint from the captured application execution behavior and performance monitor information; in a training mode, when the first fingerprint and a second fingerprint are determined to be within a similarity threshold based on a distance metric, cluster the first fingerprint and the second fingerprint to be stored in a fingerprint database with a classification; in a deployed mode, classify a third fingerprint, the third fingerprint to be classified with the classification associated with the cluster of fingerprints when a comparison of the third fingerprint to the cluster of fingerprints from the fingerprint database using the distance metric is within the similarity threshold; and trigger a remedial action when the classification is malicious. ### Claim at position 26 -33. (canceled)