System and method for monitoring power consumption to detect malware
A system and method (referred to as the system) detects malware, viruses, and/or malicious activity by generating a direct current source power consumption profile by causing a monitored device to execute a fully automated recurrent software operation. The system receives by an automated detection system, the direct current source power consumption profile generated by an intelligent power sensor and generates by a detection engine, a power security profile that identifies suspicious code by profiling direct current consumed by monitored type devices. The system executes a detection engine remote from the monitored device that identifies an infected device.
1. A method comprising:
generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device;
generating a direct current source power consumption profile by causing the monitored device to execute a fully automated recurrent software operation;
receiving by an automated detection system the direct current source power consumption profile generated by an intelligent power sensor;
generating by a detection engine a power security profile that identifies a suspicious code by profiling a direct current consumed by monitored type devices; and
executing by a detection engine remote from the monitored device an identification of an infected device;
where the non-malicious fully automated recurrent code is generated remote from the monitored device; and
where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is not generated.
2. The method of claim 1 wherein the recurrent software operation occurs at regular time or frequency intervals during the time in which a monitored device is actuated.
3. The method of claim 1 wherein the detection of the infected device occurs when a power profile mark below a noise floor is not detected.
4. The method of claim 3 wherein the detection of the infected device occurs when the power profile mark exceeds a threshold.
5. The method of claim 1 wherein the detection of the infected device occurs when a power profile mark exceeds a threshold.
6. The method of claim 1 wherein the recurrent software operation comprises executing only a plurality of kernel application program interface (API) calls.
7. The method of claim 1 wherein the power security profile is generated by an unsupervised anomaly detection.
8. The method of claim 7 wherein the power security profile is generated by a plurality of supervised anomaly detections.
9. The method of claim 1 wherein the identification is based on a detected power signal shape.
10. The method of claim 1 wherein the identification is based on measured distances of power-based signals.
11. The method of claim 1 wherein the identification is based on a measured shape distances of power-based signals.
12. The method of claim 1 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs during a processors idle operating states.
13. The method of claim 1 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs when scanning a registry of the monitored device.
14. A non-transitory machine-readable medium encoded with machine-executable instructions, wherein execution of the machine-executable instructions is for:
generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device;
generating a direct current source power consumption profile by causing the monitored device to execute a fully automated recurrent software operation;
receiving by an automated detection system the direct current source power consumption profile generated by an intelligent power sensor;
generating by a detection engine a power security profile that identifies suspicious code by profiling direct current consumed by monitored type devices; and
executing by a detection engine remote from the monitored device an identification of an infected device
where the non-malicious fully automated recurrent code is generated remote from the monitored device; and
where the suspicious code is identified when the direct current consumed is below a threshold due because a power profile associated with the non-malicious fully automated recurrent code is missing.
15. The non-transitory machine-readable medium of claim 14 wherein the recurrent software operation occurs at regular time period or at frequency intervals in which the monitored device is actuated.
16. The non-transitory machine-readable medium of claim 14 wherein the detection of the infected device occurs when a power profile mark below a noise floor is not detected.
17. The non-transitory machine-readable medium of claim 16 wherein the detection of the infected device occurs when the power profile mark exceeds a threshold.
18. The non-transitory machine-readable medium of claim 14 wherein the detection of the infected device occurs when a power profile mark exceeds a threshold.
19. The non-transitory machine-readable medium of claim 16 wherein the recurrent software operation comprises executing only a plurality of kernel application program interface (API) calls.
20. The non-transitory machine-readable medium of claim 16 wherein the power security profile is generated by an unsupervised anomaly detection.
21. The non-transitory machine-readable medium of claim 20 wherein the power security profile is generated by a plurality of supervised anomaly detections.
22. The non-transitory machine-readable medium of claim 16 wherein the identification is based on a detected power signal shape.
23. The non-transitory machine-readable medium of claim 14 wherein the identification is based on measured distances of power-based signals.
24. The non-transitory machine-readable medium of claim 14 wherein the identification is based on measured shape distances of power-based signals.
25. The non-transitory machine-readable medium of claim 16 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs during a processors idle operating states.
26. The non-transitory machine-readable medium of claim 16 wherein the direct current source power consumption profile generated by the intelligent power sensor reflects power consumption that occurs when scanning a registry of the monitored device.
27. A system comprising:
a remote device that generates a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes a power level below a noise floor of the monitored device;
a monitored device that executes a fully automated recurrent software operation;
an intelligent power sensor that generates direct current source power consumption profiles from a monitored device;
a detection engine that generates a power security profile that identifies suspicious code by profiling a direct current consumed by monitored type devices;
where the non-malicious fully automated recurrent code is generated remote from the monitored device; and
where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is not generated; and
where the detection engine remote from the monitored device an identifies infected devices by processing the direct current source power consumption profiles with the power security profiles.
28. A system comprising:
means for generating a non-malicious fully automated recurrent code that executes a fully automated recurrent software operation on a monitored device that operates on a periodic operating schedule and consumes power below a noise floor;
means for generating a direct current source power consumption profile by causing monitored device to execute the fully automated recurrent software operation;
means for receiving by an automated detection system the direct current source power consumption profile generated by an intelligent power sensor;
means for generating by a detection engine a power security profile that identifies suspicious code by profiling a direct current consumed by monitored type devices; and
means for executing by a detection engine remote from the monitored device an identification of an infected device; p 1 where the non-malicious fully automated recurrent code is generated remote from the monitored device; and
where the suspicious code is identified when the direct current consumed is below a threshold because a power profile associated with the non-malicious fully automated recurrent code is missing.