Detection of a class of processes
A system and method may determine if a class of process (e.g. NN execution, cryptocurrency mining, graphic processing) is executing on a processor, or which class is executing, by calculating or determining features from execution telemetry or measurements collected from processors executing processes, and determining from at least a subset of the features the likelihood that the processor is executing the class of process. Execution telemetry may include data regarding or describing the execution of the process, or describing hardware used to execute the process, such as processor temperature, memory usage, etc.
1 . A method of determining if a class of process is executing on a processor among a plurality of processors, the method comprising:
deriving, using one or more of mean, average, rolling average, standard deviation, rolling standard deviation, number of unique entries, and Z-score, a plurality of features from a type of execution telemetry measurement collected from a processor executing a process, at least two of the features associated with a different period of time, and at least two features associated with the same telemetry measurement;
providing the plurality of features to a machine learning model comprising a random forest algorithm to determine from the plurality of features the likelihood that the processor is executing the class of process, the random forest algorithm combining the output of a plurality of decision trees, at least some of the decision trees trained using a different feature for a root and using bootstrap aggregating; and
providing output including the likelihood and the processor associated with the likelihood.
2 . The method of claim 1 , wherein the class of process is cryptocurrency mining.
3 . The method of claim 1 , wherein the execution telemetry comprises data regarding the execution of the process.
4 . The method of claim 1 , wherein the execution telemetry is selected from the list consisting of device power usage; memory usage; processor temperature, transmission of packets from a processor; and receiving of packets to a processor.
5 . The method of claim 1 , wherein the type of execution telemetry measurement comprises one or more of the number of packets transmitted from a processor executing a process; and the number of packets received from the processor.
6 . The method of claim 1 , wherein the processor is executing a plurality of classes of processes at the same time.
7 . The method of claim 1 , comprising providing a visual report showing data from a plurality of classes of processes, wherein data from each class of process indicates a count of telemetry measurements per data bin.
8 . A system for determining if a class of process is executing on a processor among a plurality of processors, the system comprising:
a memory; and
a processor to:
derive, using one or more of mean, average, rolling average, standard deviation, rolling standard deviation, number of unique entries, and Z-score, a plurality of features from a type of execution telemetry measurement collected from a processor executing a process, at least two of the features associated with a different period of time and at least two features associated with the same telemetry measurement;
provide the plurality of features to a machine learning model comprising a random forest algorithm to determine from the plurality of features the likelihood that the processor is executing the class of process, the random forest algorithm combining the output of a plurality of decision trees, at least some of the decision trees trained using a different feature for a root and using bootstrap aggregating; and
provide output including the likelihood and the processor associated with the likelihood.
9 . The system of claim 8 , wherein the class of process is cryptocurrency mining.
10 . The system of claim 8 , wherein the execution telemetry comprises data regarding the execution of the process.
11 . The system of claim 8 , wherein the execution telemetry is selected from the list consisting of device power usage; memory usage; processor temperature, transmission of packets from a processor; and receiving of packets to a processor.
12 . A method of determining the likelihood of a process executing on a processor among a plurality of processors, the method comprising:
deriving, using one or more of mean, average, rolling average, standard deviation, rolling standard deviation, number of unique entries, and Z-score, a plurality of features from a type of telemetry measurement collected from one or more components associated with execution of the process, at least two of the features associated with a different period of time and at least two of the features associated with the same telemetry measurement;
providing the plurality of features to a machine learning model comprising a random forest algorithm to determine the likelihood of the process executing from the features, the random forest algorithm combining the output of a plurality of decision trees, at least some of the decision trees trained using a different feature for a root and using bootstrap aggregating; and
providing output including the likelihood and the processor associated with the likelihood.
13 . The method of claim 12 , wherein the process is cryptocurrency mining.
14 . The method of claim 12 , wherein the telemetry is selected from the list consisting of device power usage; memory usage;
processor temperature, transmission of packets from a processor; and receiving of packets to a processor.