Columbia University

John Demme

Lakshminarasimhan Sethumadhavan

Adrian Tang

Sal Stolfo

Matthew Maycock

Jared Schmitz

Robert Martin

Disclosed are devices, systems, apparatus, methods, products, media and other implementations, including a method that includes obtaining hardware-based micro-architectural data, including hardware-based micro-architectural counter data, for a hardware device executing one or more processes, and determining based, at least in part, on the hardware-based micro-architectural data whether at least one of the one or more processes executing on the hardware device corresponds to a malicious process. In some embodiments, determining based on the hardware-based micro-architectural data whether the at least one of the one or more processes corresponds to a malicious process may include applying one or more machine-learning procedures to the hardware-based micro-architectural data to determine whether the at least one of the one or more processes corresponds to the malicious process.

Detection of anomalous program execution using hardware-based micro-architectural data

Disclosed are devices, systems, apparatus, methods, products, and other implementations, including a method that includes identifying a process to obtain timing information of a processor-based device, and in response to identifying the process to obtain the timing information, delaying delivery of the timing information for a time-delay period. In some embodiments, identifying the process to obtain the timing information may include identifying a request to obtain the timing information of the processor-based device. In some embodiments, identifying the process to obtain the timing information may include identifying a memory-access process.

Systems and methods to counter side channel attacks

Method for providing precise microprocessor performance counter readings including detecting a swap back to a monitored process executing in a microprocessor. In response to the detected swap back to the monitored process, if the value read from the performance counter does not exceed the defined overflow threshold, the value of the performance counter stored in the first memory location is restored to the performance counter. If the value read from the performance counter exceeds the defined overflow threshold, the performance counter is set to zero and the value of the performance counter stored in the first memory location is used to increment an overflow memory location. If the value read from the performance counter exceeds the defined overflow threshold, at least one performance counter reading instruction is detected and in response to the detected at least one performance counter reading instruction, setting the counter output register to zero.

Growing community of inventors

New York, NY, United States of America

John Demme