Threat detection using hardware physical properties and operating system metrics with AI data mining
An approach is provided that receives a set of actual hardware power consumption details and a set of software activity details with all of the details pertaining to the use of a computer system at a first time. Based on the set of software activity details, the approach determines a set of expected hardware power consumption details. The set of actual hardware power consumption details are compared to the set of expected hardware power consumption details. If the comparison identifies variances between the actual and expected data, then a security threat is flagged and threat responses are performed.
1. A method implemented by an information handling system that includes a processor and a memory accessible by the processor, the method comprising:
training a machine learning (ML) system to determine expected hardware power consumption, wherein the training is based on a first power consumption, a first set of system data pertaining to a first operating system, and a first set of process data pertaining to one or more first processes;
receiving a set of actual hardware power consumption details pertaining to the use of a computer system;
receiving a set of software activity details pertaining to the use of the computer system, wherein the set of software activity details includes a second set of system data pertaining to the operating system of the computer system and a second set of process data pertaining to one or more processes executing on the computer system, wherein the first set of system data and the second set of system data includes an operating system version, an operating system level, and a processor type, and wherein the first set of process data and the second set of process data includes a processor usage, a number of threads, a memory usage, and a set of port usage information;
determining a set of expected hardware power consumption details based on the set of software activity details, wherein the determining comprises
inputting, to the trained ML system, the set of software activity details pertaining to the use of the computer system; and
receiving, from the trained ML system, the set of expected hardware power consumption details based on the set of software activity details;
comparing the set of actual hardware power consumption details to the set of expected hardware power consumption details; and
in response to the comparison identifying one or more variances that exceed one or more thresholds, performing one or more threat responses.
2. The method of claim 1 wherein the set of actual hardware power consumption details include at least one reading from the set of details consisting of a temperature reading, a voltage reading, and an electrical current reading, and wherein the set of software activity details further include at least one detail from the set of details consisting of a plurality of process identifications corresponding to the one or more processes executing on the computer system, a CPU usage, a memory usage, and a number of ports used.
3. The method of claim 1 wherein the first set of system data and the second set of system data further includes a set of operating system applied patches, a processor age, and a processor vendor.
4. An information handling system comprising:
one or more processors;
a memory coupled to at least one of the processors; and
a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions comprising:
training a machine learning (ML) system to determine expected hardware power consumption, wherein the training is based on a first power consumption, a first set of system data pertaining to a first operating system, and a first set of process data pertaining to one or more first processes;
receiving a set of actual hardware power consumption details pertaining to the use of a computer system;
receiving a set of software activity details pertaining to the use of the computer system, wherein the set of software activity details includes a second set of system data pertaining to the operating system of the computer system and a second set of process data pertaining to one or more processes executing on the computer system, wherein the first set of system data and the second set of system data includes an operating system version, an operating system level, and a processor type, and wherein the first set of process data and the second
set of process data includes a processor usage, a number of threads, a memory usage, and a set of port usage information;
determining a set of expected hardware power consumption details based on the set of software activity details, wherein the determining comprises:
inputting, to the trained ML system, the set of software activity details pertaining to the use of the computer system; and
receiving, from the trained ML system, the set of expected hardware power consumption details based on the set of software activity details;
comparing the set of actual hardware power consumption details to the set of expected hardware power consumption details; and
in response to the comparison identifying one or more variances that exceed one or more thresholds, performing one or more threat responses.
5. The information handling system of claim 4 wherein the set of actual hardware power consumption details further include at least one reading from the set of details consisting of a temperature reading, a voltage reading, and an electrical current reading, and wherein the set of software activity details include at least one detail from the set of details consisting of a plurality of process identifications corresponding to the one or more processes executing on the computer system, a CPU usage, a memory usage, and a number of ports used.
6. The information handling system of claim 4 wherein the first set of system data and the second set of system data includes, a set of operating system applied patches, a processor age, and a processor vendor.
7. A computer program product stored in a computer readable storage medium, comprising computer program code that, when executed by an information handling system, performs actions comprising:
training a machine learning (ML) system to determine expected hardware power consumption, wherein the training is based on a first power consumption, a first set of system data pertaining to a first operating system, and a first set of process data pertaining to one or more first processes;
receiving a set of actual hardware power consumption details pertaining to the use of a computer system;
receiving a set of software activity details pertaining to the use of the computer system, wherein the set of software activity details includes a second set of system data pertaining to the operating system of the computer system and a second set of process data pertaining to one or more processes executing on the computer system, wherein the first set of system data and the second set of
system data includes an operating system version, an operating system level, and a processor type, and wherein the first set of process data and the second set of process data includes a processor usage, a number of threads, a memory usage, and a set of port usage information;
determining a set of expected hardware power consumption details based on the set of software activity details, wherein the determining further comprises:
inputting, to the trained ML system, the set of software activity details pertaining to the use of the computer system; and
receiving, from the trained ML system, the set of expected hardware power consumption details based on the set of software activity details;
comparing the set of actual hardware power consumption details to the set of expected hardware power consumption details; and
in response to the comparison identifying one or more variances that exceed one or more thresholds, performing one or more threat responses.
8. The computer program product of claim 7 wherein the set of actual hardware power consumption details include at least one reading from the set of details consisting of a temperature reading, a voltage reading, and an electrical current reading, and wherein the set of software activity details further include at least one detail from the set of details consisting of a plurality of process identifications corresponding to the one or more processes executing on the computer system, a CPU usage, a memory usage, and a number of ports used.
9. The computer program product of claim 7 wherein the first set of system data and the second set of system data includes, a set of operating system applied patches, a processor age, and a processor vendor.