# US 2020/0396236 A1 · Anomaly and malware detection using side channel analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396236 A1 - Document ID: US20200396236A1 - Status: Published application - Kind: A1 - Application number: 16/908,045 - Filed: 2020-06-22 - Published: 2020-12-17 - Earliest claimed: 2015-01-14 - Assignees: Virta Laboratories, Inc. - Applicants: Virta Laboratories, Inc. - Inventors: Denis Foo Kune; Benjamin Andrew Ransford; Daniel Edward Holcomb - Web page: https://patentgrep.com/patent/US20200396236A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 1/28: Supervision thereof, e.g. detecting power-supply failure by out of limits supervision - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L 41/06: Management of faults, events, alarms or notifications - H04Q 9/00: Arrangements in telecontrol or telemetry systems for selectively calling a substation from a main station, in which substation desired apparatus is selected for applying a control signal thereto or for obtaining measured values therefrom - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04Q: SELECTING (switches, relays, selectors H01H; wireless communication networks H04W) ## Abstract The present disclosure describes systems and methods for detecting malware. More particularly, the system includes a monitoring device that monitors side-channel activity of a target device. The monitoring device that can work in conjunction with (or independently of) a cloud-based security analytics engine to perform anomaly detection and classification on the side-channel activity. For example, the monitoring device can calculate a first set of features that are then transmitted to the security analytics engine for anomaly detection and classification. ## Claims ### Claim at position 1 1-20. (canceled) ### Claim 21 A system, comprising; a power supply receiving electric current from an alternating current (AC) source, and providing the electric current to a target device; a monitoring component integrated with the power supply, the monitoring component comprising a sensor and one or more processors, wherein the sensor generates a signal corresponding to an amount of the electric current provided to the target device, and the one or more processors are configured to: sample the signal generated by the sensor to create a plurality of current samples; store the plurality of current samples in a data structure in a memory element of the monitoring component; retrieve a subset of the plurality of current samples from the data structure stored in the memory element; calculate a feature sample comprising at least one of a root-mean-square value or a skew value of the subset of the plurality of current samples; transmit the feature sample to a remote server; receive a classification of the feature sample from the remote server; and generate an alarm signal responsive to the classification of the feature sample indicating an anomaly. ### Claim 22 (depends on 21) The system of claim 21, wherein the AC source is a wall outlet, and wherein the power supply is electrically coupled to a power cable configured to receive the electric current from the wall outlet. ### Claim 23 (depends on 21) The system of claim 21, wherein the monitoring component further comprises an analog-to-digital converter that receives the signal generated by the sensor and produces a corresponding digital signal; and wherein the one or more processors are further configured to create the plurality of current samples by sampling the corresponding digital signal produced by the analog-to-digital converter. ### Claim 24 (depends on 21) The system of claim 21, wherein the sensor comprises at least one of a current-sense resistor, a current transformer, or a Hall-effect sensor. ### Claim 25 (depends on 21) The system of claim 21, wherein the monitoring component comprises at least one of an acoustic sensor or an electromagnetic sensor, and the one or more processors are further configured to: receive a second signal from the acoustic sensor or the electromagnetic sensor; sample the second signal to generate a plurality of second samples; and generate the feature sample further based on at least one of the plurality of second samples. ### Claim 26 (depends on 21) The system of claim 21, wherein the one or more processors are further configured to calculate a frequency content for the subset of the plurality of current samples in each of a plurality of frequency bins. ### Claim 27 (depends on 21) The system of claim 21, wherein the one or more processors are further configured to calculate, as part of the feature sample, at least one of a mean, a variance, a kurtosis, or a standard deviation of the plurality of current samples. ### Claim 28 (depends on 21) The system of claim 21, wherein the one or more processors are further configured to: receive an instruction from the remote server to increase a sampling rate at which the signal generated by the sensor is sampled; and increase the sampling rate at which the signal generated by the sensor is sampled based on the instruction. ### Claim 29 A system, comprising; a target device receiving electric current from an alternating current (AC) source via a power supply; a monitoring component integrated with the target device, the monitoring component comprising a sensor and one or more processors, wherein the sensor generates a signal corresponding to an amount of the electric current received by the target device, and the one or more processors are configured to: sample the signal generated by the sensor to create a plurality of current samples; store the plurality of current samples in a data structure in a memory element of the monitoring component; retrieve a subset of the plurality of current samples from the data structure stored in the memory element; calculate a feature sample comprising at least one of a root-mean-square value or a skew value of the subset of the plurality of current samples; transmit the feature sample to a remote server; receive a classification of the feature sample from the remote server; and generate an alarm signal responsive to the classification of the feature sample indicating an anomaly. ### Claim 30 (depends on 29) The system of claim 29, wherein the AC source is a wall outlet, and wherein the target device receives the electric current from the wall outlet via the power supply. ### Claim 31 (depends on 29) The system of claim 29, wherein the monitoring component further comprises an analog-to-digital converter that receives the signal generated by the sensor and produces a corresponding digital signal; and wherein the one or more processors are further configured to create the plurality of current samples by sampling the corresponding digital signal produced by the analog-to-digital converter. ### Claim 32 (depends on 29) The system of claim 29, wherein the sensor comprises at least one of a current-sense resistor, a current transformer, or a Hall-effect sensor. ### Claim 33 (depends on 29) The system of claim 29, wherein the monitoring component comprises at least one of an acoustic sensor or an electromagnetic sensor, and the one or more processors are further configured to: receive a second signal from the acoustic sensor or the electromagnetic sensor; sample the second signal to generate a plurality of second samples; and generate the feature sample further based on at least one of the plurality of second samples. ### Claim 34 (depends on 29) The system of claim 29, wherein the one or more processors are further configured to calculate a frequency content for the subset of the plurality of current samples in each of a plurality of frequency bins. ### Claim 35 (depends on 29) The system of claim 29, wherein the one or more processors are further configured to calculate, as part of the feature sample, at least one of a mean, a variance, a kurtosis, or a standard deviation of the plurality of current samples. ### Claim 36 (depends on 29) The system of claim 29, wherein the one or more processors are further configured to: receive an instruction from the remote server to increase a sampling rate at which the signal generated by the sensor is sampled; and increase the sampling rate at which the signal generated by the sensor is sampled based on the instruction. ### Claim 37 A surge protector with an integrated monitoring component, comprising: a plurality of connectors each configured to provide electric current to at least one target device from an alternating current (AC) source; a monitoring component comprising a plurality of sensors and one or more processors, wherein: the plurality of sensors each correspond to a respective connector of the plurality of connectors, each of the plurality of sensors configured to generate a signal corresponding to an amount of the electric current provided by the respective connector; and the one or more processors are configured to: sample the signals generated by the plurality of sensors to create a plurality of current samples for each of the plurality of connectors; store the plurality of current samples for each of the plurality of connectors in a data structure in a memory element of the monitoring component; retrieve a subset of the plurality of current samples corresponding to a first connector of the plurality of connectors from the data structure stored in the memory element; calculate a feature sample comprising a root-mean-square value or a skew value of the subset of the plurality of current samples; transmit the feature sample to a remote server; receive a classification of the feature sample from the remote server; and generate, responsive to the classification of the feature sample indicating an anomaly, an alarm signal that identifies the at least one target device receiving the electric current from the first connector. ### Claim 38 (depends on 37) The surge protector of claim 37, wherein the AC source is a wall outlet, and wherein the surge protector is electrically coupled to a power cable configured to receive the electric current from the wall outlet. ### Claim 39 (depends on 37) The surge protector of claim 37, wherein the monitoring component further comprises one or more analog-to-digital converters that receive the signals generated by the plurality of sensors and produce corresponding digital signals; and wherein the one or more processors create the plurality of current samples for each of the plurality of connectors by sampling the corresponding digital signals produced by the one or more analog-to-digital converters. ### Claim 40 (depends on 37) The surge protector of claim 37, wherein the one or more processors are further configured to calculate a frequency content for the subset of the plurality of current samples in each of a plurality of frequency bins.