Mcafee, Inc.

Intel Corporation

Zheng Zhang

Ned M Smith

Thiago Jose Macieira

Glen J Anderson

Igor G Muttik

Justin E Gottschlich

Tobias Max Kohlenberg

Mark Y Kelly

Keith Nolan

Michael J Nolan

John Douglas Teddy

John Brady

Craig D Schmugar

Rahuldeva Ghosh

Rajesh Poornachandran

Kathiravetpillai Sivanesan

Liuyang L Yang

Gregory Burns

Debabani Choudhury

Jonathan Lewis Edwards

William C Deleeuw

Joel Robert Spurlock

Xiruo Liu

Kuilin Clark Chen

Sridhar G Sharma

Aditya Kapoor

Maarten Koning

Niall Cahill

Cliodhna Ni Scanaill

Davide Carboni

Moreno Ambrosin

Ravikiran Chukka

Arthur S Zeigler

Khai Nhu Pham

Jakub Wenus

Yair Yona

Eugene Ryan

Richard Davies

Paul Carlson

Toby M Kohlenberg

Ravi L Sahita

Wei Ey Li

Jason Martin

Li Chen

Salmin Sultana

Abhilasha Bhargav-Spantzel

Mingwei Zhang

Kunal Mehta

Michael S Hughes

Rachit Mathur

Erdem Aktas

Clint R Merrill

Priyam Biswas

Taj Un Nisha N

Prajesh Ambili Rajendran

Deepak Kumar Mishra

The Internet can be configured to provide communications to a large number of Internet-of-Things (IoT) devices. Devices can be designed to address the need for network layers, from central servers, through gateways, down to edge devices, to grow unhindered, to discover and make accessible connected resources, and to support the ability to hide and compartmentalize connected resources. Network protocols can be part of the fabric supporting human accessible services that operate regardless of location, time, or space. Innovations can include service delivery and associated infrastructure, such as hardware and software. Services may be provided in accordance with specified Quality of Service (QoS) terms. The use of IoT devices and networks can be included in a heterogeneous network of connectivity including wired and wireless technologies.

Internet of things

A secure performance monitoring unit of a processor includes one or more performance monitoring counters and a secure group manager. The secure group manager is configured to receive a request to create a secure counter group from a software (SW) process being executed by a processor, the request including identification of the one or more counters; determine availability of the one or more counters, creating the secure counter group, assign the one or more counters to the secure counter group, and save a public key of the SW process, when the one or more counters are available; receive and save a private key for the secure counter group; receive a request to configure the secure counter group from the SW process; verify the configuration using the public key of the SW process; and begin sampling of the one or more counters when the configuration is verified.

Performance monitoring unit of a processor deterring tampering of counter configuration and enabling verifiable data sampling

A trusted communications environment includes a primary participant with a group creator and a distributed ledger, and a secondary participant with communication credentials. An Internet of Things (IoT) network includes a trusted execution environment with a chain history for a blockchain, a root-of-trust for chaining, and a root-of-trust for archives. An IoT network includes an IoT device with a communication system, an onboarding tool, a device discoverer, a trust builder, a shared domain creator, and a shared resource directory. An IoT network includes an IoT device with a communication system, a policy decision engine, a policy repository, a policy enforcement engine, and a peer monitor. An IoT network includes an IoT device with a host environment and a trusted reliability engine to apply a failover action if the host environment fails. An IoT network includes an IoT server including secure booter/measurer, trust anchor, authenticator, key manager, and key generator.

Blockchains for securing IoT devices

A performance monitoring unit of a processor includes one or more performance monitoring counters, and a behavioral detector to sample data from a set of the one or more performance monitoring counters, analyze the sampled data, and identify a type of workload of a software process being executed by the processor.

Automatic profiling of application workloads in a performance monitoring unit using hardware telemetry

Methods, apparatus, systems, and articles of manufacture are disclosed to detect attacks in V2X networks. An example apparatus includes a challenge handler to (a) transmit a first challenge packet to a first vehicle to request a transmission of a first response, (b) instruct a second challenge packet to be transmitted to a second vehicle to request a transmission of a second response, (c) increment a first counter when the first response is not obtained, (d) increment a second counter when the second response is not obtained, and (e) after repeating (a)-(d), determine that the first and second vehicles are phantom vehicles associated with an attacker with a half-duplex radio when at least one of the first or second counters satisfy a threshold, and a network interface to instruct a third vehicle associated with the V2X network to ignore future messages from the phantom vehicles based on the determination.

Methods and apparatus for detecting attacks in V2X networks

Examples for device-driven auto-recovery using multiple recovery sources are disclosed herein. At least one storage device or storage disk includes instructions that, when executed, cause at least one processor to at least detect a flaw in a first configuration of a program to be installed on a programmable device, the first configuration recorded on a first chain of a distributed ledger of a blockchain; correct the flaw in the first configuration to generate a corrected configuration; commit the corrected configuration to the distributed ledger, the corrected configuration to create a second chain of the distributed ledger; detect an update of the first configuration to a first updated configuration and an update to the corrected configuration to an updated corrected configuration; and prevent the first updated configuration from being installed on the programmable device by replacing the first updated configuration with the updated corrected configuration on the second chain.

Systems, apparatus, and methods for updating a programmable device using a distributed ledger

A method comprises generating a first set of hardware performance counter (HPC) events that is ranked based on an ability of an individual HPC event to profile a malware class, generating a second set of HPC event combinations that is ranked based on an ability of a set of at least two joint HPC events to profile a malware class, generating a third set of extended HPC event combinations, profiling one or more malware events and one or more benign applications to obtain a detection accuracy parameter for each malware event, applying a machine learning model to rank the third set of HPC event combinations based on malware detection accuracy, and applying a genetic algorithm to the third set of HPC event combinations to identify a subset of the third set of extended combinations of HPC events to be used for malware detection and classification.

Method and apparatus to identify hardware performance counter events for detecting and classifying malware or workload using artificial intelligence

A technique for detecting malware involves loading known malware information, finding a string in the known malware information, saving the string in a first database, identifying a first contiguous string block from the known malware information, assigning a confidence indicator to the first contiguous string block, attempting to find the first contiguous string block in a second database containing one or more contiguous string blocks extracted from known malware, and responsive to a determination the first contiguous string block meets a predetermined threshold of similarity with a second contiguous string block contained in the second database, labelling the first contiguous string block.

System and method for malware signature generation

A method, a computer-readable medium, and a device for dynamically identifying criticality of services and data sources. The computer-readable medium comprising instructions which, when executed, cause a programmable device to: determine, based on a plurality of service-related metrics from a network node, upstream network nodes and downstream network nodes in a network; query the upstream network nodes and the downstream network nodes with a multicast request for an additional plurality of service-related metrics; extrapolate a current network topology based on the plurality of service-related metrics and the additional plurality of service-related metrics; determine whether or not an upstream backup server is present for the network node; determine a set of critical service delivery points in the network based on the determination of the upstream backup server; and generate a network service alert responsive to a service interruption from the set of critical service delivery points.

Dynamically identifying criticality of services and data sources

Methods, systems, articles of manufacture and apparatus to detect process hijacking are disclosed herein. An example apparatus to detect control flow anomalies includes a parsing engine to compare a target instruction pointer (TIP) address to a dynamic link library (DLL) module list, and in response to detecting a match of the TIP address to a DLL in the DLL module list, set a first portion of a normalized TIP address to a value equal to an identifier of the DLL. The example apparatus disclosed herein also includes a DLL entry point analyzer to set a second portion of the normalized TIP address based on a comparison between the TIP address and an entry point of the DLL, and a model compliance engine to generate a flow validity decision based on a comparison between (a) the first and second portion of the normalized TIP address and (b) a control flow integrity model.

Methods, systems, articles of manufacture and apparatus to detect process hijacking

There is disclosed in one example a network device, including: a hardware platform including at least a processor and a memory; a communication interface; and stored instructions on the memory to instruct the processor to provide a health monitoring engine (HME) configured to: communicatively couple to a network via the network interface; construct a reference template during a training period; observe watchdog behavior on the network during an observation period; identify an abnormality in the watchdog behavior including a substantial variance from the reference template; and trigger a resilience response to the substantial variance.

Monitoring and analyzing watchdog messages in an internet of things network environment

Apparatus, systems, methods, and articles of manufacture for fingerprinting and classifying application behaviors using telemetry are disclosed. An example apparatus includes a trace processor to process events in a processor trace to capture application execution behavior; a fingerprint extractor to extract a first fingerprint from the captured application execution behavior and performance monitor information; a fingerprint clusterer to, in a training mode cluster the first fingerprint and the second fingerprint into a cluster of fingerprints to be stored in a fingerprint database with a classification; and a fingerprint classifier to, in a deployed mode, classify a third fingerprint, the fingerprint classifier to trigger a remedial action when the classification is malicious.

Systems and methods to fingerprint and classify application behaviors using telemetry

Growing community of inventors

Portland, OR, United States of America

Zheng Zhang