Methods and apparatus of anomalous memory access pattern detection for translational lookaside buffers

1. An apparatus comprising:

a communication interface to retrieve a first eviction data set from a translational lookaside buffer associated with a central processing unit;

a machine learning engine to:

generate an anomaly detection model based upon at least one of a second eviction data set not including an anomaly and a third eviction data set including the anomaly; and

obtain a notification of a process identifier of a process performing a priming of a first eviction set;

determine that the process with the process identifier is the same process that reads pages corresponding to the first eviction set;

perform machine learning analysis on event time series of the first eviction set to determine whether the anomaly is present in the first eviction data set based on the anomaly detection model; and

an alert generator to at least one of modify a bit value or terminate memory access operations when the anomaly is determined to be present.

2. An apparatus as defined in claim 1 , wherein the translational lookaside buffer includes a monitor to track access to the translational lookaside buffer.

3. An apparatus as defined in claim 2 , wherein the monitor is to communicate information about the access to the translational lookaside buffer to a performance monitoring unit of the central processing unit.

4. An apparatus as defined in claim 3 , wherein the performance monitoring unit includes counters to count accesses to the translational lookaside buffer.

5. An apparatus as defined in claim 3 , wherein the performance monitoring unit includes event types corresponding to accesses to the translational lookaside buffer.

6. An apparatus as defined in claim 2 , wherein the access is a hit on the translational lookaside buffer.

7. An apparatus as defined in claim 2 , wherein the access is a miss on the translational lookaside buffer.

8. A method comprising:

retrieving a first eviction data set from a translational lookaside buffer associated with a central processing unit;

generating an anomaly detection model based upon at least one of a second eviction data set not including an anomaly and a third eviction data set including the anomaly;

obtaining a notification of a process identifier of a process performing a priming of a first eviction set;

determining that the process with the process identifier is the same process that reads pages corresponding to the first eviction set;

performing machine learning analysis on event time series of the first eviction set to determine whether the anomaly is present in the first eviction data set based on the anomaly detection model; and

at least one of modifying a bit value or terminating memory access operations when the anomaly is determined to be present.

9. A method as defined in claim 8 , wherein the translational lookaside buffer includes a monitor to track access to the translational lookaside buffer.

10. A method as defined in claim 9 , further comprising communicating information about the access to the translational lookaside buffer to a performance monitoring unit of the central processing unit.

11. A method as defined in claim 10 , wherein the performance monitoring unit includes counters to count accesses to the translational lookaside buffer.

12. A method as defined in claim 10 , wherein the performance monitoring unit includes event types corresponding to accesses to the translational lookaside buffer.

13. A method as defined in claim 9 , wherein the access is a hit on the translational lookaside buffer.

14. A method as defined in claim 9 , wherein the access is a miss on the translational lookaside buffer.

15. A non-transitory computer readable medium comprising instructions that, when executed, cause a machine to at least:

retrieve a first eviction data set from a translational lookaside buffer associated with a central processing unit;

generate an anomaly detection model based upon at least one of a second eviction data set not including an anomaly and a third eviction data set including the anomaly;

obtain a notification of a process identifier of a process performing a priming of a first eviction set;

determine that the process with the process identifier is the same process that reads pages corresponding to the first eviction set;

perform machine learning analysis on event time series of the first eviction set to determine whether the anomaly is present in the first eviction data set based on the anomaly detection model; and

at least one of modify a bit value or terminate memory access operations when the anomaly is determined to be present.

16. A non-transitory computer readable medium as defined in claim 15 , wherein the translational lookaside buffer includes a monitor to track access to the translational lookaside buffer.

17. A non-transitory computer readable medium as defined in claim 16 , further comprising communicating information about the access to the translational lookaside buffer to a performance monitoring unit of the central processing unit.

18. A non-transitory computer readable medium as defined in claim 17 , wherein the performance monitoring unit includes counters to count accesses to the translational lookaside buffer.

19. A non-transitory computer readable medium as defined in claim 17 , wherein the performance monitoring unit includes event types corresponding to accesses to the translational lookaside buffer.

20. A non-transitory computer readable medium as defined in claim 16 , wherein the access is a hit on the translational lookaside buffer.

21. A non-transitory computer readable medium as defined in claim 16 , wherein the access is a miss on the translational lookaside buffer.