Office Action 3: Notice of Allowance (2024-08-07)

CLAIMS:
Amendments to the Claims:

This listing of claims will replace all prior versions, and listings, of claims in the application:

1\. (Currently Amended) A system comprising:
memory;
a microcontroller including an analog-to-digital converter (ADC) and in communication with the memory and configured to:define a fingerprint that includes a baseline measurement of side-channel traces of a side-channel of a separate processor retrieved from the ADC, during an enrollment period of the system, wherein the enrollment period includes measuring a voltage of the separate processor prior to runtime operation via a power supply pin of the ADC. whereintheADC includes a security register;
receive a runtime measurement from the ADC regarding the voltage of at least the separate processor during runtime, wherein the runtime measurement is retrieved directly from the power supply pin;
compare the runtime measurement to the fingerprint; and
in response to the measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks, wherein the countermeasure operation is associated with a context defined by the runtime measurement from the ADC.
2\. (Original) The system of claim 1, wherein the countermeasure includes outputting a message or a notification.SVG {EMBED HERE} 0.080.05

3\. (Original) The system of claim 1, wherein the ADC includes an ADC input pin connected to an internal voltage pin of the microcontroller, a powers supply, an internal regulator, or an intermediate voltage.

4\. (Currently Amended) The system of claim 1, wherein the ADC includes an encryption unit that receives output via security register, wherein the security register is accessible upon passing security measures.
5\. (Currently Amended) The system of claim 4,wherein the ADC includes an ADC input pin connected to an internal voltage pin of the microcontroller to measure drain power voltage.
6\. (Original) The system of claim 1, wherein a channel of the side-channel includes a higher bandwidth than other channels of the side-channel, wherein the channel is utilized for the baseline measurement.
7\. (Original) The system of claim 1, wherein the ADC is connected via a least one data bus to the separate processor, wherein the ADC includes at least one channel connected via a secure bus that requires encryption or authentication or both.
8\. (Cancelled)
9\. (Original) The system of claim 1, wherein a channel of the side-channel includes a higher sampling rate than other channels of the side-channel of the ADC, wherein the channel is utilized for the baseline measurement.

10\. (Cancelled)

11\. (Currently Amended) A computer-implement method, comprising:
defining a fingerprint that includes a baseline measurement retrieved from a side- channel of at least a separate processor during an enrollment period, wherein the baseline measurement includes one or more physical attributes received from an analog-to-digital converter (ADC) of a microcontroller;

receiving a runtime measurement from the ADC, wherein the runtime measurement includes the one or more physical attributes of at least the separate processor during runtime, wherein the runtime measurement is retrieved directly from a power supply pin of the ADC;
comparing the runtime measurement of the physical attribute to the fingerprint; and in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks, wherein the countermeasure operation is associated with a context defined by the runtime measurement from the ADC.

12\. (Original) The computer-implemented method of claim 11, wherein the physical attribute includes a voltage.

13\. (Currently Amended) A system comprising:
memory;
a microcontroller including an analog-to-digital converter (ADC) and in communication with the memory and configured to:define a fingerprint that includes a baseline measurement of side-channel traces of a side-channel retrieved from the ADC, during an enrollment period of the system, wherein the enrollment period includes measuring voltage prior to runtime operation, wherein the ADC includes a security register accessible upon passing security measures;
receive a runtime measurement from the ADC that includes voltage of at least a separate microcontroller during runtime, wherein the runtime measurement is retrieved from a power supply pin of the ADC;
compare the runtime measurement to the fingerprint; and
in response to the measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks.

14\. (Original) The system of claim 13, wherein the runtime measurement is retrieved from a connection between an input supply pin of the ADC and a voltage supply of the microcontroller.

15\. (Original) The system of claim 13, wherein the runtime measurement is retrieved from a connection between an input supply pin of the ADC and a ground of the microcontroller.

16\. (Original) The system of claim 13, wherein the runtime measurement is retrieved from no connection with an input supply pin of the ADC, wherein the runtime measurement includes parasitic noise of the ADC.

17\. (Original) The system of claim 13, wherein the countermeasure operation includes reprogramming the software to original code.

18\. (Original) The system of claim 13, wherein the countermeasure operation includes reprogramming the software.

19\. (Original) The system of claim 13, wherein the side-channel is associated with a separate microcontroller.

20\. (Currently Amended) The system of claim 13, wherein runtime measurement is sent to an intrusion detection system (IDS)segregated from the separate processor and MCU, wherein the IDSis configured to compare the runtime measurement to the baseline measurement utilizing a neural network, wherein the IDS is further configured to access a security register of the MCU during operation of the IDS.

21\. (New) The system of claim 1, wherein the microcontroller includes a reference voltage control register configured to control a reference voltage of the system.

22\. (New) The system of claim 21, wherein the reference voltage control register is accessible only by a secure element or during a system operation.

OFFICE ACTION:
DETAILED ACTION
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The text of those sections of Title 35 U.S. Code not included in this section can be found in the prior office action.
The prior office actions are incorporated herein by reference. In particular, the observations with respect to claim language, and response to previously presented arguments.
The examiner is withdrawing the double patenting rejection in view of the different scopes of the claims brought about as a result of the various amendments made to the independent claims of both the applications.
Claims 1-7, 9, and 11-22, now renumbered as claims 1-20, have been examined.
EXAMINER’S AMENDMENT
Authorization for this examiner’s amendment was given in an interview with Mr. Mark A. Jotanovic on 07/22/2024.
Claims have been amended as follows:
1. (Currently Amended) A system comprising:
memory;
a microcontroller including an analog-to-digital converter (ADC) and in communication with the memory and configured to:
define a fingerprint that includes a baseline measurement of side-channel traces of a side-channel of a separate processor retrieved from the ADC, during an enrollment period of the system, wherein the enrollment period includes measuring a voltage of the separate processor prior to runtime operation via a power supply pin of the ADC, wherein the ADC includes a security register that is accessible upon passing security measures;
receive a runtime measurement from the ADC regarding the voltage of at least the separate processor during runtime, wherein the runtime measurement is retrieved directly from the power supply pin;
compare the runtime measurement to the fingerprint; and
in response to the measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks, wherein the countermeasure operation is associated with a context defined by the runtime measurement from the ADC.
4. (Currently Amended) The system of claim 1, wherein the ADC includes an encryption unit that receives output via security register
11. (Currently Amended) A computer-implement method, comprising:
defining a fingerprint that includes a baseline measurement retrieved from a side- channel of at least a separate processor during an enrollment period, wherein the baseline measurement includes one or more physical attributes received from an analog-to-digital converter (ADC) of a microcontroller, wherein the ADC includes a security register that is accessible upon passing security measures;
receiving a runtime measurement from the ADC, wherein the runtime measurement includes the one or more physical attributes of at least the separate processor during runtime, wherein the runtime measurement is retrieved directly from a power supply pin of the ADC;
comparing the runtime measurement of the physical attribute to the fingerprint; and
in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks, wherein the countermeasure operation is associated with a context defined by the runtime measurement from the ADC.
Allowable Subject Matter
Claims 1-7, 9, and 11-22 are allowed over prior art of record.
Response to Arguments
Applicant’s arguments, see Remarks, filed 04/08/2024, have been fully considered.
Examiner's Statement of Reasons for Allowance
The following is an examiner’s statement of reasons for allowance:
Independent claims 1, 11, and 13 are allowed in view of the examiner’s amendment and for reasons presented by the applicant in the Remarks. Claims 2-7, 9, 12, and 14-22 depend on one of the above independent claims and are therefore, allowed by virtue of their dependency.
Prior art of record Khalid teaches:  A signature power behavior of a given integrated circuit is obtained at the pre-market test stage. During the runtime operation of the IC, the an analog-to-digital converter (ADC) measures current from the power ports of the IC to obtain the runtime power profile of the IC. The runtime power profile is compared to the signature power behavior to determine if there is an intrusion attack on the IC. Prior art of record Aasheim teaches: A power measurement circuit includes an ADC. The power supply pin of the ADC is coupled to an embedded device to measure power consumption. A power profiler uses the measured power consumption to generate a power profile that quantifies the power consumed for the precise software instruction executing on a processor of embedded device. Prior art of record Gonzalez teaches: When it is determined that there is an anomaly or intrusion in a target device based on the measurements from an ADC, automatic actions are triggered. The correct actions to take are determined based on evaluating a response policy and depend on the context such as detecting malware, anomalous behavior in the side channels, etc.
However, the prior arts fail to teach: “wherein the ADC includes a security register that is accessible upon passing security measures”.
None of the prior art of record, either taken by itself or in any combination, would have anticipated or made obvious the invention of the present application at or before the time it was filed.
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee.  Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
US 10685118 to Prowell et al: A system and method (referred to as the system) detects malware, viruses, and/or malicious activity by generating a direct current source power consumption profile by causing a monitored device to execute a fully automated recurrent software operation. The system receives by an automated detection system, the direct current source power consumption profile generated by an intelligent power sensor and generates by a detection engine, a power security profile that identifies suspicious code by profiling direct current consumed by monitored type devices. The system executes a detection engine remote from the monitored device that identifies an infected device.

APPLICANT REBUTTAL: Remarks
Reconsideration of the above-identified application in view of the present Amendment is respectfully requested
Claims 1-20 are currently rejected. Claims 1, 11, and 13 are currently amended. No new matter has been added by these amendments. The independent claim amendments are supported by at least paragraphs 29-31 and 39-41. Claim 4 for example is supported by at least paragraphs 39-42 of the Specification. Claims 8 and 10 are now cancelled. Claims 21-22 are new and are also supported.
Double Patentin
g
Claims 1-20 are provisionally rejected on the grounds of nonstatutory double patenting as being unpatentable over claims 1-20 of Application No. 16/723,861 in view of U.S. Publication No. 2004/0268159 to Aasheim et al., hereinafter Aasheim. These claims are moot in view of the amendments.
Re
jection Under 35 U.
S.C. $103
Claims 1-3, 7-9, 11-14, and 17-19 are rejected under 35 U.S.C. § 103 as being unpatentable over Non-Patent Literature "Behavior Profiling of Power Distribution Networks for Runtime Hardware Trojan Detection" to Khalid et al., Khalid, in view of U.S. Patent Publication 2004/0268159 Aasheim et al ("Aasheim") and U.S. Patent No. 10157278 to Gonzalez et al., ("Gonzalez"). The Rejection is moot in view of the amendments. For example, the prior art in combination fails to include a "security register" as claimed or "wherein the countermeasure operation is associated with a context defined by the runtime measurement from the ADC." Nor would it be obvious to combine any prior art reference to include a "security register" as claimed, because the prior art of record fails to utilize other sources for security and avoid utilizing registers for security. For at least these reasons, the claims are in condition for allowance.
Claim 4 is rejected under 35 U.S.C. § 103 as being unpatentable over Khalid in view of Aasheim and Gonzalez as applied to claim 1 above, and further in view of Non-Patent Literature "An Encryption-Authentication Unified A/D Conversion Scheme for loT Sensor Nodes" to Gadde et al., hereinafter Gadde. Claim 4 is allowable based on the reasons set forth above.
Claims 5, 6, and 20 are rejected under 35 U.S.C. § 103 as being unpatentable Khalid in view of Aasheim and Gonzalez as applied to claims 1 and 13 above and further in view of U.S. Publication No. 2015/0317475 to Gonzalez et al., hereinafter '475 Gonzalez. These claims are allowable based on the reasons set forth above.
Claims 10 and 16 are rejected under 35 U.S.C. § 103 as being unpatentable over Khalid in view of Aasheim and Gonzalez as applied to claims 1 and 13 above and further in view of Non- Patent Literature "Measurements of spurious emission with a time-domain EMI measurement system using multi-sampling techniques" to Braun et al., hereinafter Braun. Claims 10 and 16 are allowable based on the reasons set forth above.
Summar
y
Applicant has made a genuine effort to respond to the rejections and advance prosecution of this application. Applicant respectfully submits that all formal and substantive requirements for patentability have been met and that this case is in condition for allowance, which action is respectfully requested.
The Examiner is requested to telephone the undersigned to discuss resolution of any remaining issues.
No additional fee is believed be due as a result of filing this paper. However, please charge any fees or credit any overpayments as a result of the filing of this paper to Deposit Account No. 04-1061.
Respectfully submitted, Dickinson Wright PLLCBy:


CITED REFERENCE SUMMARIES: Ref US10685118B2: Claims:
A method comprising: generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device; generating a direct current source power consumption profile by causing the monitored device to execute a fully automated recurrent software operation; receiving by an automated detection system the direct current source power consumption profile generated by an intelligent power sensor; generating by a detection engine a power security profile that identifies a suspicious code by profiling a direct current consumed by monitored type devices; and executing by a detection engine remote from the monitored device an identification of an infected device; where the non-malicious fully automated recurrent code is generated remote from the monitored device; and where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is not generated.
generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device;
generating a direct current source power consumption profile by causing the monitored device to execute a fully automated recurrent software operation;
receiving by an automated detection system the direct current source power consumption profile generated by an intelligent power sensor;
generating by a detection engine a power security profile that identifies a suspicious code by profiling a direct current consumed by monitored type devices; and
executing by a detection engine remote from the monitored device an identification of an infected device;
where the non-malicious fully automated recurrent code is generated remote from the monitored device; and
where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is not generated.
The method of claim 1 wherein the recurrent software operation occurs at regular time or frequency intervals during the time in which a monitored device is actuated.
The method of claim 1 wherein the detection of the infected device occurs when a power profile mark below a noise floor is not detected.
The method of claim 3 wherein the detection of the infected device occurs when the power profile mark exceeds a threshold.
The method of claim 1 wherein the detection of the infected device occurs when a power profile mark exceeds a threshold.
The method of claim 1 wherein the recurrent software operation comprises executing only a plurality of kernel application program interface (API) calls.
The method of claim 1 wherein the power security profile is generated by an unsupervised anomaly detection.
The method of claim 7 wherein the power security profile is generated by a plurality of supervised anomaly detections.
The method of claim 1 wherein the identification is based on a detected power signal shape.
The method of claim 1 wherein the identification is based on measured distances of power-based signals.
The method of claim 1 wherein the identification is based on a measured shape distances of power-based signals.
The method of claim 1 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs during a processors idle operating states.
The method of claim 1 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs when scanning a registry of the monitored device.
A non-transitory machine-readable medium encoded with machine-executable instructions, wherein execution of the machine-executable instructions is for: generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device; generating a direct current source power consumption profile by causing the monitored device to execute a fully automated recurrent software operation; receiving by an automated detection system the direct current source power consumption profile generated by an intelligent power sensor; generating by a detection engine a power security profile that identifies suspicious code by profiling direct current consumed by monitored type devices; and executing by a detection engine remote from the monitored device an identification of an infected device where the non-malicious fully automated recurrent code is generated remote from the monitored device; and where the suspicious code is identified when the direct current consumed is below a threshold due because a power profile associated with the non-malicious fully automated recurrent code is missing.
generating by a detection engine a power security profile that identifies suspicious code by profiling direct current consumed by monitored type devices; and
executing by a detection engine remote from the monitored device an identification of an infected device
where the suspicious code is identified when the direct current consumed is below a threshold due because a power profile associated with the non-malicious fully automated recurrent code is missing.
The non-transitory machine-readable medium of claim 14 wherein the recurrent software operation occurs at regular time period or at frequency intervals in which the monitored device is actuated.
The non-transitory machine-readable medium of claim 14 wherein the detection of the infected device occurs when a power profile mark below a noise floor is not detected.
The non-transitory machine-readable medium of claim 16 wherein the detection of the infected device occurs when the power profile mark exceeds a threshold.
The non-transitory machine-readable medium of claim 14 wherein the detection of the infected device occurs when a power profile mark exceeds a threshold.
The non-transitory machine-readable medium of claim 16 wherein the recurrent software operation comprises executing only a plurality of kernel application program interface (API) calls.
The non-transitory machine-readable medium of claim 16 wherein the power security profile is generated by an unsupervised anomaly detection.
The non-transitory machine-readable medium of claim 20 wherein the power security profile is generated by a plurality of supervised anomaly detections.
The non-transitory machine-readable medium of claim 16 wherein the identification is based on a detected power signal shape.
The non-transitory machine-readable medium of claim 14 wherein the identification is based on measured distances of power-based signals.
The non-transitory machine-readable medium of claim 14 wherein the identification is based on measured shape distances of power-based signals.
The non-transitory machine-readable medium of claim 16 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs during a processors idle operating states.
The non-transitory machine-readable medium of claim 16 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs when scanning a registry of the monitored device.
A system comprising: a remote device that generates a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device; a monitored device that executes a fully automated recurrent software operation; an intelligent power sensor that generates direct current source power consumption profiles from a monitored device; a detection engine that generates a power security profile that identifies suspicious code by profiling a direct current consumed by monitored type devices; where the non-malicious fully automated recurrent code is generated remote from the monitored device; and where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is not generated; and where the detection engine remote from the monitored device an identifies infected devices by processing the direct current source power consumption profiles with the power security profiles.
a remote device that generates a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device;
a monitored device that executes a fully automated recurrent software operation;
an intelligent power sensor that generates direct current source power consumption profiles from a monitored device;
a detection engine that generates a power security profile that identifies suspicious code by profiling a direct current consumed by monitored type devices;
where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is not generated; and
where the detection engine remote from the monitored device an identifies infected devices by processing the direct current source power consumption profiles with the power security profiles.
A system comprising: means for generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes power below a noise floor; means for generating a direct current source power consumption profile by causing monitored device to execute the fully automated recurrent software operation; means for receiving by an automated detection system the direct current source power consumption profile generated by an intelligent power sensor; means for generating by a detection engine a power security profile that identifies suspicious code by profiling a direct current consumed by monitored type devices; and means for executing by a detection engine remote from the monitored device an identification of an infected device; p 1 where the non-malicious fully automated recurrent code is generated remote from the monitored device; and where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is missing.
means for generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes power below a noise floor;
means for generating a direct current source power consumption profile by causing monitored device to execute the fully automated recurrent software operation;
means for receiving by an automated detection system the direct current source power consumption profile generated by an intelligent power sensor;
means for generating by a detection engine a power security profile that identifies suspicious code by profiling a direct current consumed by monitored type devices; and
means for executing by a detection engine remote from the monitored device an identification of an infected device; p 1 where the non-malicious fully automated recurrent code is generated remote from the monitored device; and
where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is missing.
Ref US10685118: Claims:
1. A method comprising:
generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device;
generating a direct current source power consumption profile by causing the monitored device to execute a fully automated recurrent software operation;
receiving by an automated detection system the direct current source power consumption profile generated by an intelligent power sensor;
generating by a detection engine a power security profile that identifies a suspicious code by profiling a direct current consumed by monitored type devices; and
executing by a detection engine remote from the monitored device an identification of an infected device;
where the non-malicious fully automated recurrent code is generated remote from the monitored device; and
where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is not generated.
2. The method of claim 1 wherein the recurrent software operation occurs at regular time or frequency intervals during the time in which a monitored device is actuated.
3. The method of claim 1 wherein the detection of the infected device occurs when a power profile mark below a noise floor is not detected.
4. The method of claim 3 wherein the detection of the infected device occurs when the power profile mark exceeds a threshold.
5. The method of claim 1 wherein the detection of the infected device occurs when a power profile mark exceeds a threshold.
6. The method of claim 1 wherein the recurrent software operation comprises executing only a plurality of kernel application program interface (API) calls.
7. The method of claim 1 wherein the power security profile is generated by an unsupervised anomaly detection.
8. The method of claim 7 wherein the power security profile is generated by a plurality of supervised anomaly detections.
9. The method of claim 1 wherein the identification is based on a detected power signal shape.
10. The method of claim 1 wherein the identification is based on measured distances of power-based signals.
11. The method of claim 1 wherein the identification is based on a measured shape distances of power-based signals.
12. The method of claim 1 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs during a processors idle operating states.
13. The method of claim 1 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs when scanning a registry of the monitored device.
14. A non-transitory machine-readable medium encoded with machine-executable instructions, wherein execution of the machine-executable instructions is for:
generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device;
generating a direct current source power consumption profile by causing the monitored device to execute a fully automated recurrent software operation;
receiving by an automated detection system the direct current source power consumption profile generated by an intelligent power sensor;
generating by a detection engine a power security profile that identifies suspicious code by profiling direct current consumed by monitored type devices; and
executing by a detection engine remote from the monitored device an identification of an infected device
where the non-malicious fully automated recurrent code is generated remote from the monitored device; and
where the suspicious code is identified when the direct current consumed is below a threshold due because a power profile associated with the non-malicious fully automated recurrent code is missing.
15. The non-transitory machine-readable medium of claim 14 wherein the recurrent software operation occurs at regular time period or at frequency intervals in which the monitored device is actuated.
16. The non-transitory machine-readable medium of claim 14 wherein the detection of the infected device occurs when a power profile mark below a noise floor is not detected.
17. The non-transitory machine-readable medium of claim 16 wherein the detection of the infected device occurs when the power profile mark exceeds a threshold.
18. The non-transitory machine-readable medium of claim 14 wherein the detection of the infected device occurs when a power profile mark exceeds a threshold.
19. The non-transitory machine-readable medium of claim 16 wherein the recurrent software operation comprises executing only a plurality of kernel application program interface (API) calls.
20. The non-transitory machine-readable medium of claim 16 wherein the power security profile is generated by an unsupervised anomaly detection.
21. The non-transitory machine-readable medium of claim 20 wherein the power security profile is generated by a plurality of supervised anomaly detections.
22. The non-transitory machine-readable medium of claim 16 wherein the identification is based on a detected power signal shape.
23. The non-transitory machine-readable medium of claim 14 wherein the identification is based on measured distances of power-based signals.
24. The non-transitory machine-readable medium of claim 14 wherein the identification is based on measured shape distances of power-based signals.
25. The non-transitory machine-readable medium of claim 16 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs during a processors idle operating states.
26. The non-transitory machine-readable medium of claim 16 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs when scanning a registry of the monitored device.
27. A system comprising:
a remote device that generates a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device;
a monitored device that executes a fully automated recurrent software operation;
an intelligent power sensor that generates direct current source power consumption profiles from a monitored device;
a detection engine that generates a power security profile that identifies suspicious code by profiling a direct current consumed by monitored type devices;
where the non-malicious fully automated recurrent code is generated remote from the monitored device; and
where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is not generated; and
where the detection engine remote from the monitored device an identifies infected devices by processing the direct current source power consumption profiles with the power security profiles.
28. A system comprising:
means for generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes power below a noise floor;
means for generating a direct current source power consumption profile by causing monitored device to execute the fully automated recur
[Truncated to input limit]