Rootkit detection system

1. A non-transitory computer-readable medium having stored thereon software instructions that, when executed by a processor, cause the processor to:

injecting, by an injection module, a repetitive software code that causes a malware in a monitored device to render a detectable direct current power consumption profile;

generating, by a guide wave generator, a guide wave signal that establishes an observational window, that is applied to data that represent a direct current source power consumption of a monitored device;

extracting, by an extraction device, a portion of the data that represent the direct current source power consumption of the monitored device;

comparing, by a deviation engine, a plurality of operating characteristics of the monitored device against a plurality of normal operating state characteristics of the monitored device without identifying a baseline factor from a second device or identifying a second data generated from the second devices; and

identifying, by the deviation engine based on the comparing, the malware on the monitored device, without processing data associated with a prior identification of the malware or identifying a source of the malware or identifying a location of the malware on the monitored device.

2. The non-transitory computer-readable medium of claim 1 where repetitive software code causes the execution of a plurality of repetitive tasks that render a distinctive power trace.

3. The non-transitory computer-readable medium of claim 1 where repetitive software code causes the execution of a plurality of application programming interface call functions that render a distinctive power trace.

4. The non-transitory computer-readable medium of claim 1 where the data renders a representation of the direct current source power consumption of a monitored device during the execution of the repetitive software code.

5. The non-transitory computer-readable medium of claim 4 where the guide wave causes the extraction device to amplify a portion of the representation of the direct current source power consumption extracted by the extraction device.

6. The non-transitory computer-readable medium of claim 5 where the guide wave causes the extraction device to attenuate a second portion of the representation of the direct current source power consumption extracted by the extraction device.

7. The non-transitory computer-readable medium of claim where the comparing comprises an execution of a probability density algorithm.

8. The non-transitory computer-readable medium of claim 7 where the comparing comprises an execution of an entropy algorithm.

9. The non-transitory computer-readable medium of claim 1 further comprising generating, by the monitored device, training data indicative of a potential infectious state without identifying the malware.

10. The non-transitory computer-readable medium of claim 9 further comprising training a deviation model on the data indicative of the potential infectious state.

11. The non-transitory computer-readable medium of claim 9 where the training data is generated during an incubation state before a full infection state occurs.

12. The non-transitory computer-readable medium of claim 9 further comprising draining traffic from the monitored device when the deviation model predicts a potentially infected operating state.

13. The non-transitory computer-readable medium of claim 9 further comprising notifying a server cluster when the deviation model predicts a potentially infected operating state.

14. The non-transitory computer-readable medium of claim 9 further comprising determining when the monitored device should stop receiving a new processing session when the deviation model predicts a potentially infected operating state.

15. The non-transitory computer-readable medium of claim 9 further comprising determining when to allowing an operating session to expire when the deviation model predicts a potentially infected operating state.

16. The non-transitory computer-readable medium of claim 9 further comprising determining when to allowing an operating session to expire when the deviation model predicts a potentially infected operating state.

17. The non-transitory computer-readable medium of claim 9 where identifying, by a deviation engine, the malware on the monitored device occurs when a rendered signal exceeds a predetermined threshold.

18. The non-transitory computer-readable medium of claim 9 where the extraction device comprises a lock-in analyzer that operates in an analog domain.

19. The non-transitory computer-readable medium of claim 9 where the extraction device comprises a field programmable array that operates in a digital domain.

20. The non-transitory computer-readable medium of claim 9 where the extraction device comprises a homodyne detector.

21. A method of detecting infectious software code, comprising:

injecting, by an injection module, a repetitive software code that causes a malware in a monitored device to render a detectable direct current power consumption profile;

generating, by a guide wave generator, a guide wave signal that establishes an observational window, that is applied to data that represent a direct current source power consumption of a monitored device;

extracting, by an extraction device, a portion of the data that represent the direct current source power consumption of the monitored device;

comparing, by a deviation engine, a plurality of operating characteristics of the monitored device against a plurality of normal operating state characteristics of the monitored device without identifying a baseline factor from a second device of identifying a second data generated from the second devices; and

identifying, by the deviation engine based on the comparing, the malware on the monitored device, without processing data associated with a prior identification of the malware or identifying a source of the malware or identifying a location of the malware on the monitored device.

22. A system that detects infectious software code, comprising:

an injection module that injects a repetitive software code that causes a malware in a monitored device to render a detectable direct current power consumption profile;

a guide wave generator that generates a guide wave signal that establishes an observational window that is applied to data that represent a direct current source power consumption of a monitored device;

an extraction device that extracts a portion of the data that represent the direct current source power consumption of the monitored device; and

a deviation engine that

compares a plurality of operating characteristics of the monitored device against a plurality of normal operating state characteristics of the monitored device without identifying a baseline factor from a second device or identifying a second data generated from the second devices to render a comparison, and detects based on the comparison, the malware on the monitored device, without processing data associated with a prior identification of the malware or identifying a source of the malware or identifying a location of the malware on the monitored device.

23. The method of claim 21 where the comparing comprises using a probability density function that compares entropy between the monitored device's current operating state to the monitored device's normal operating state.

24. The system of claim 22 where the comparison uses a probability density function that compares entropy between the monitored device's current operating state to the monitored device's normal operating state.