Arm Limited

Izuma Tech, Inc.

Arm IP Limited

Michael Bartling

Brendan James Moran

Hugo John Martin Vincent

Christopher Haster

Kevin Olen Gilbert

James M Brisson

Archie David Licudi

A method and apparatus to classify processor events is provided. The apparatus includes a reference generator, a warping unit, a correlation unit and a detector. The reference generator provides a self-reference for an event vector stream based on a history of the event vector stream and the warping unit dynamically aligns the event vector stream with the self-reference to generate a warped event vector stream. The correlation unit determines a window-by-window correlation of event vectors of the warped event vector stream, and the detector passes a window of event vectors of the warped event vector stream to a behavioral classifier when the window-by-window correlation achieves a threshold value. The behavioral classifier may use machine learning. A sample reservoir may be used to store dynamically selected event vectors of the event vector stream that are used, at least in part, to generate the self-reference.

Dynamic windowing for processing event streams

A live attack shadow replay can be performed at a shadow replay box that receives a snapshot of a computer program executed by an operating system of a device; mirrors an execution environment of the snapshot; determines a typical execution of the computer program comprising a first set of variables; performs a static analysis on the snapshot of the computer program to determine a second set of variables; determines a divergence between the first set of variables and the second set of variables; marks variables of the second set of variables that are associated with the divergence; replays a portion of the computer program corresponding to at least the snapshot; and monitors the marked variables of the second set of variables during the replaying of the portion of the computer program.

Live attack shadow replay of software

A behavioral sensor for creating consumable events can include: a feature extractor coupled to receive an event stream of events performed by a circuit, wherein the feature extractor identifies features of a particular event of the event stream and associates the particular event with a time; and a classifier coupled to receive the features of the particular event from the feature extractor, wherein the classifier classifies the particular event into a classified event associated with the time using predefined categories based on the received features of the particular event; whereby the classified event and subsequent classified events extracted from the event stream within a time frame are appended in a time series forming the consumable events.

Behavioral sensor for creating consumable events

There is provided an apparatus and method, the apparatus comprising storage circuitry to store event information associated with instructions occurring between instrumentation points. The event information indicates a plurality of different types of events expected to occur during execution of the instructions. The event information comprises, for each event, type information indicating a type of that event and an expected number of occurrences of that event. The apparatus is also provided with monitoring circuitry comprising a plurality of programmable counters. The monitoring circuitry is responsive to a start instrumentation point, to assign at least a subset of the plurality of programmable counters to measure, during execution of the program instructions, occurrences of the plurality of different types of events identified in the event information. The monitoring circuitry is responsive to at least one counter deviating from the expected number of occurrences indicated by that counter, to perform a predetermined action.

Monitoring of program instructions

A data processing apparatus is provided that includes forecast circuitry for generating a forecast of an aspect of a system for a next future time and for one or more subsequent future times following the next future time. Measurement circuitry generates, at the next future time, a new measurement of the aspect of the system. Aggregation circuitry produces an aggregation of the forecast of the aspect of the system for the next future time and of the new measurement of the aspect of the system. The forecast circuitry revises the forecast of the aspect of the system for the one or more subsequent future times using the aggregation.

Forecast revision

A data processing apparatus is provided that includes storage circuitry to store a plurality of interconnected instructions. Analysis circuitry analyses the instructions to determine a degree of uniqueness of profile measurements of a control flow path fragments within the instructions.

Profiling

A method of tracking a history of firmware program updates. The method includes reading current descriptions of current application programming interfaces from a history log. The current application programming interfaces correspond to current software modules. The current software modules form a current firmware program of a target device. The method also includes accessing updated software modules and new descriptions of new application programming interfaces of an updated firmware program. The updated firmware program is created from the current firmware program. The method further includes appending the new descriptions to the current descriptions in the history log, reading the new descriptions of the new application programming interfaces from the history log, generating an updated linkage for the updated firmware program by adding new links for the new application programming interfaces, and storing the updated software modules and the updated linkage in the history log.

Tracking history of firmware program updates

The present disclosure advantageously provides a computer-based method for partitioning software for an embedded system with a memory protection unit (MPU). Object code within a plurality of object files is converted to intermediate code. A call graph is generated based on the intermediate code. The call graph is transformed into a directed flow graph, which includes updating the call graph's node weights and directed edge weights. The directed flow graph is partitioned into a target number of MPU memory regions, which includes assigning each element of the object code to one of the MPU memory regions. Each element of the object code is relocated to a new object file that corresponds to the assigned MPU memory region. An MPU configuration object file is created that includes one or more configuration parameters for each MPU memory region.

Memory protection unit boundary partitioning based on compiled software objects

Techniques, supported by corresponding apparatuses and methods, are disclosed for monitoring execution of software in a trusted environment and generating path signatures which are characteristic of the behaviour of the software. Multiple approximate nearest neighbour searching hash tables are generated in dependence on such path signatures and on attribute information defining behavioural classifications for the path signatures. Later execution of the software in a non-trusted environment is monitoring and an observed path signature characteristic of the behaviour of the software is generated. This observed path signature is queried against the multiple approximate nearest neighbour searching hash tables and a behavioural classification is determined in dependence on hash collision-based similarity between the observed path signature and the content of the multiple approximate nearest neighbour searching hash tables.

Monitoring execution of software using path signature

Techniques, supported by corresponding apparatuses and methods, are disclosed for monitoring execution of software and generating path signatures which are characteristic of the behaviour of the software. Multiple approximate nearest neighbour searching hash tables are generated in dependence on such path signatures. Observed path signatures are also compared against the previously generated content of these runtime multiple approximate nearest neighbour searching hash tables and a behavioural classification is determined in dependence on hash collision-based similarity between the observed path signature and the content of the multiple approximate nearest neighbour searching hash tables.

Monitoring execution of software using online path signatures

Disclosed are techniques for encoding a set of sensor content symbols at least in part via applying a processing window of an adjustable size.

Growing community of inventors

Austin, TX, United States of America

Michael Bartling