Secure behavior analysis over trusted execution environment

A computing device, comprising a multi-core processor including two or more processor cores, one or more of which is configured with processor-executable instructions to perform operations comprising:

• observing a computing device behavior in an observer module in a privileged-normal portion of a secure operating environment of the computing device;
• generating a concise behavior vector in the privileged-normal portion of the secure operating environment based on the observations;
• sending the concise behavior vector across a secure protection boundary of the secure operating environment of the computing device by sending the concise behavior vector from the privileged-normal portion of the secure operating environment to an analyzer module in an unprivileged-secure portion of the secure operating environment;
• and
• determining whether the computing device behavior may be classified as one of benign and non-benign based on a result of applying the concise behavior vector to a classifier model in the unprivileged-secure portion of the secure operating environment.

A computing device, comprising:

• means for observing a computing device behavior in an observer module in a privileged-normal portion of a secure operating environment of the computing device;
• means for generating a concise behavior vector in the privileged-normal portion of the secure operating environment based on the observations;
• means for sending the concise behavior vector across a secure protection boundary of the secure operating environment of the computing device by sending the concise behavior vector from the privileged-normal portion of the secure operating environment to an analyzer module in an unprivileged-secure portion of the secure operating environment;
• and
• means for determining whether the computing device behavior may be classified as one of benign and non-benign based on a result of applying the concise behavior vector to a classifier model in the unprivileged-secure portion of the secure operating environment.

A non-transitory processor-readable storage medium having stored thereon processor-executable instructions configured to cause a processor of a computing device to perform operations comprising:

• observing a computing device behavior in an observer module in a privileged-normal portion of a secure operating environment of the computing device;
• generating a concise behavior vector in the privileged-normal portion of the secure operating environment based on the observations;
• sending the concise behavior vector across a secure protection boundary of the secure operating environment of the computing device by sending the concise behavior vector from the privileged-normal portion of the secure operating environment to an analyzer module in an unprivileged-secure portion of the secure operating environment;
• and
• determining whether the computing device behavior may be classified as one of benign and non-benign based on a result of applying the concise behavior vector to a classifier model in the unprivileged-secure portion of the secure operating environment.