Patent Document ID: 10025929
Application ID: 14778007
Patent Flag: 1

Claim One:
1. A method for detection of anomalous program execution using hardware-based micro-architectural data using performance counters internal to one or more processors and configured to count internal events of the one or more processors, the method comprising: obtaining hardware-based micro-architectural data, including hardware-based time-varying micro-architectural performance counter data, for a hardware device executing one or more processes, wherein the time-varying micro-architectural performance counter data measures instruction-level events that occur on one or more circuits of the hardware device, wherein the events are internal to the one or more processors executing said processes, the events are counted on performance counters of said one or more processors, and the performance counters are configured to count said events; applying one or more machine-learning procedures to the obtained hardware-based micro-architectural data of the hardware device to determine whether at least one of the one or more processes executing on the hardware device corresponds to an anomalous process, wherein applying one or more machine-learning procedures comprises classifying the obtained hardware-based time-varying micro-architectural performance counter data based on previously identified patterns of hardware-based micro-architectural data associated with one or more anomalous processes; determining that the at least one of the one or more processes corresponds to an anomalous process based on the applied one or more machine-learning procedures; and terminating the execution of the at least one of the one or more processes determined to correspond to an anomalous process.