Intel Corporation

Mcafee, Inc.

Rahuldeva Ghosh

David L Graumann

Ranjit S Narjala

Scott Pfursich

Ansuya Negi

Zheng Zhang

Paul Carlson

Baiju V Patel

Zhong Chen

Selvakumar Panneer

Sanjay Bakshi

Roksana Golizadeh Mojarad

Amin Heydarpour

Taj Un Nisha N

Prajesh Ambili Rajendran

Deepak Kumar Mishra

The present disclosure is directed to systems and methods for detecting side-channel exploit attacks such as Spectre and Meltdown. Performance monitoring circuitry includes first counter circuitry to monitor CPU cache misses and second counter circuitry to monitor DTLB load misses. Upon detecting an excessive number of cache misses and/or load misses, the performance monitoring circuitry transfers the first and second counter circuitry data to control circuitry. The control circuitry determines a CPU cache miss to DTLB load miss ratio for each of a plurality of temporal intervals. The control circuitry the identifies, determines, and/or detects a pattern or trend in the CPU cache miss to DTLB load miss ratio. Upon detecting a deviation from the identified CPU cache miss to DTLB load miss ratio pattern or trend indicative of a potential side-channel exploit attack, the control circuitry generates an output to alert a system user or system administrator.

Side-channel exploit detection

A secure performance monitoring unit of a processor includes one or more performance monitoring counters and a secure group manager. The secure group manager is configured to receive a request to create a secure counter group from a software (SW) process being executed by a processor, the request including identification of the one or more counters; determine availability of the one or more counters, creating the secure counter group, assign the one or more counters to the secure counter group, and save a public key of the SW process, when the one or more counters are available; receive and save a private key for the secure counter group; receive a request to configure the secure counter group from the SW process; verify the configuration using the public key of the SW process; and begin sampling of the one or more counters when the configuration is verified.

Performance monitoring unit of a processor deterring tampering of counter configuration and enabling verifiable data sampling

A performance monitoring unit of a processor includes one or more performance monitoring counters, and a behavioral detector to sample data from a set of the one or more performance monitoring counters, analyze the sampled data, and identify a type of workload of a software process being executed by the processor.

Automatic profiling of application workloads in a performance monitoring unit using hardware telemetry

A method comprises generating a first set of hardware performance counter (HPC) events that is ranked based on an ability of an individual HPC event to profile a malware class, generating a second set of HPC event combinations that is ranked based on an ability of a set of at least two joint HPC events to profile a malware class, generating a third set of extended HPC event combinations, profiling one or more malware events and one or more benign applications to obtain a detection accuracy parameter for each malware event, applying a machine learning model to rank the third set of HPC event combinations based on malware detection accuracy, and applying a genetic algorithm to the third set of HPC event combinations to identify a subset of the third set of extended combinations of HPC events to be used for malware detection and classification.

Method and apparatus to identify hardware performance counter events for detecting and classifying malware or workload using artificial intelligence

A user authentication system and method. A two-dimensional image of a scene is obtained and range information obtained from the scene is aligned with the two-dimensional image. One or more depth regions is identified and image segments corresponding to the one or more depth regions are selected within the two-dimensional image. Brightness operations are performed on one or more of the selected image segments to form a corrected image.

3D enhanced image correction

Embodiments described herein provide an apparatus comprising a processor to receive, from a gaming/anti-cheating server, a message comprising a first pixel data set comprising first pixel data for one or more pixels of a watermark generated by the gaming/anti-cheating server, store the first pixel data set in the machine-readable memory, receive, from a gaming system, a frame buffer rendered by the gaming system and comprising the watermark generated by the gaming/anti-cheating server, isolate, from the frame buffer, a second pixel data set comprising second pixel data for one or more pixels corresponding to the first pixel set, and forward an alert to the gaming/anti-cheating server when the second pixel data differs from the first pixel data by an amount that exceeds a threshold. Other embodiments may be described and claimed.

Anti-cheating solution to detect graphics driver tampering for online gaming

System and techniques for spoofing detection in image biometrics are described herein. A sequence of images may be obtained from a camera; a first plurality of images in the sequence of images including a representation of a user body part, and a second plurality of images in the sequence of images including a representation of an environment of the user. A marker may be created for the representation of the body part. A feature of the environment of the user present during the second plurality of images may be identified in the sequence of images using a third group of circuits. A correlation between the marker and the feature of the environment in the sequence of images may be quantified to produce a synchronicity metric of the degree to which the marker and the feature of the environment correlate.

Spoofing detection in image biometrics

System and techniques for preventing face-based authentication spoofing are described herein. A visible light emitter may be controlled to project a pattern into a camera's field of view during an authentication attempt. An image may be obtained from the camera for the authentication attempt. A potential spoofing region on image may be identified by finding the pattern. An authentication attempt based on a face found in the potential spoofing region may be prevented.

Preventing face-based authentication spoofing

Display screen with animated graphical user interface

A system and method for capturing an image of a user. An image is captured with a camera, wherein the image includes a user's image. A first avatar is displayed in a display, wherein displaying includes positioning an avatar in at least some of the user's image. The user is then encouraged to move so the first avatar moves to a second position in the display.

System and method for feature-based authentication

A user authentication system and method. The user authentication system includes a camera and a processor connected to the camera. The processor receives images from the camera, searches for a user feature in the images, determines if the images require correction, adjusts camera controls in a pre-defined order to provide desired corrections, applies the desired corrections to subsequent images and authenticates the user based on the user feature in the corrected images.

Image quality compensation system and method

Systems and techniques for facial spoofing detection in image based biometrics are described herein. A marker may be created for a representation of a face in a first plurality of images of a sequence of images. The marker corresponds to a facial feature of the face. An environmental feature of an environment of the face may be identified across a second plurality of images of the sequence of images. A correlation between the marker and the environmental feature in the sequence of images may be quantified to produce a synchronicity metric. A spoofing attempt may be indicated in response to the synchronicity metric meeting a threshold.

Growing community of inventors

Portland, OR, United States of America

Rahuldeva Ghosh