Intel Corporation

Ajay Harikumar

Tessil Thomas

Biju Puther Simon

Koichi Yamada

Alex Nayshtut

Vadim Sukhomlinov

Jiwei Lu

Venkat R Gokulrangan

Kiran Singh Panesar

Jose A Baiocchi Paredes

Tugrul Ince

Sevin F Varoglu

Abhik Sarkar

The disclosed embodiments generally relate to detecting malware through detection of micro-architectural changes (morphing events) when executing a code at a hardware level (e.g., CPU). An exemplary embodiment relates to a computer system having: a memory circuitry comprising an executable code; a central processing unit (CPU) in communication with the memory circuitry and configured to execute the code; a performance monitoring unit (PMU) associated with the CPU, the PMU configured to detect and count one or more morphing events associated with execution of the code and to determine if the counted number of morphine events exceed a threshold value; and a co-processor configured to initiate a memory scan of the memory circuitry to identify a malware in the code.

Methods, systems and apparatus to detect polymorphic malware

After a heuristic event counter in a processor has triggered a performance monitoring interrupt (PMI) when the processor was executing a target program in user mode, and after the processor has switched to kernel mode in response to the PMI, a heuristic event handler automatically performs preliminary analysis in kernel mode, without switching back to user mode, to determine whether heavyweight code analysis is warranted. The preliminary analysis comprises (a) obtaining an instruction pointer (IP) for the target program from a last branch record (LBR) buffer in the processor, (b) using transaction hardware in the processor to determine whether the IP from LBR buffer points to a readable page in memory, and (c) determining that heavyweight code analysis is not warranted in response to a determination that the page pointed to by the IP from LBR buffer is not readable. Other embodiments are described and claimed.

Systems, methods, and apparatus for detecting control flow attacks

Technologies for binary translation include a computing device that allocates a translation cache shared by all threads associated with a corresponding execution domain. The computing device assigns a thread to an execution domain, translates original binary code of the thread to generate translated binary code, and installs the translated binary code into the corresponding translation cache for execution. The computing device may allocate a global region cache, generate region metadata associated with the original binary code of a thread, and store the region metadata in the global region cache. The original binary code may be translated using the region metadata. The computing device may allocate a global prototype cache, translate the original binary code of a thread to generate prototype code, and install the prototype code in the global prototype cache. The prototype code may be a non-executable version of the translated binary code. Other embodiments are described and claimed.

Technologies for scalable translation caching for binary translation systems

In one embodiment, a binary translator to perform binary translation of code is to: perform a first binary analysis of a first code block to determine whether a second control transfer instruction is included in the first code block, where the first code block includes a return target of a first control transfer instruction; perform a second binary analysis of a second code block to determine whether the second code block includes the first control transfer instruction, where the second code block includes a call target of the second control transfer instruction; and store an address pair associated with the first control transfer instruction in a whitelist if the second control transfer instruction is included in the first code block and the first control transfer instruction is included in the second code block. Other embodiments are described and claimed.

System, apparatus and method for performing on-demand binary analysis for detecting code reuse attacks

In one aspect, the issues of events that may impact one or more partitions of sub-socket partitioning in one or more sockets can be handled. Specifically, events for partitions can be handled in a socket with sub-socket partitioning, wherein the events may include reset, interrupts, errors and reliability, availability, and serviceability (RAS) management.

Method, system and apparatus for handling events for partitions in a socket with sub-socket partitioning

Embodiments enable sub-socket partitioning that facilitates access among a plurality of partitions to a shared resource. A round robin arbitration policy is to allow each partition, within a socket, that may utilize a different operating system, access to the shared resource based at least in part on whether an assigned bandwidth parameter for each partition is consumed. Embodiments may further include support for virtual channels.

Method, system and apparatus for main memory access subsystem usage to different partitions in a socket with sub-socket partitioning

A cache that supports sub-socket partitioning is discussed. Specifically, the cache supports different quality of service levels and victim cache line selection for a cache miss operation. The different quality of service levels allow for programmable ceiling usage and floor usage thresholds that allow for different techniques for victim cache line selection.

Method, apparatus, and system for shared cache usage to different partitions in a socket with sub-socket partitioning

Sub-socket partitioning is enabled using embodiments of the present invention. In one aspect, the memory mapping is performed to isolate memory access for each of the partitions by assigning a partition address and a generated physical address.

Method, system and apparatus for memory address mapping for sub-socket partitioning

A method of booting up a computer system comprising a first multi-cored processor comprising a first plurality of cores and a second multi-cored processor comprising a second plurality of cores is disclosed. The method may comprise configuring a first partition comprising a first one or more cores from the first plurality of cores and from the second plurality of cores, configuring a second partition comprising a second one or more cores from the first plurality of cores and from the second plurality of cores, and configuring a third partition comprising a third one or more cores from the first plurality of cores and one or more cores from the second plurality of cores.

Growing community of inventors

Bengaluru, India

Ajay Harikumar