UNSUPERVISED DETECTION OF ANOMALOUS PROCESSES USING HARDWARE FEATURES

摘要

The first process comprising: obtaining hardware performance counter data containing current hardware performance data for a hardware device executing a first process associated with pre-recorded hardware performance data indicative of normal behavior; and a first process comprising: Obtained current hardware performance data corresponding to the first process from the pre-recorded hardware performance data Deviation It is based on the determination that it is based on the determination that the malicious process affects the performance of the first process , Devices, systems, devices, methods, articles, media, and other implementations are disclosed.;