Cybersecurity using fuzzy logic on energy signatures and timing signatures
A system and method for identifying compromised systems, even where cyber security measures are in place, continuously monitors system parameters against a set of predefined thresholds. If the system violates those thresholds, either instantaneously or over a period of time, the system determines that unknown processes are using the system; those processes may be unauthorized processes loaded via a successful spoof attack. The system may monitor CPU usage, power usage, temperature, memory access, data storage access, data transmission rates, etc. The system may execute some remedial action when unauthorized processes are suspected.
1 . A computer apparatus comprising:
a monitored processor; and
at least one monitoring processor configured to:
continuously receive one or more parameter values, each corresponding to an operating parameter of the monitored processor, at least one corresponding to a task rate utilization and at least one corresponding to an energy utilization;
compare the one or more parameter values to a corresponding threshold;
determine if the one or more parameter values exceeds the corresponding threshold;
produce a risk assessment; and
determine a weighted risk assessment based on the energy utilization and the task rate utilization.
2 . The computer apparatus of claim 1 , wherein the computer apparatus further comprises an energy measurement integrated circuit configured to measure energy utilization on more than one power rail.
3 . The computer apparatus of claim 1 , wherein the at least one monitoring processor is further configured to execute a remedial action when the risk assessment exceeds a threshold.
4 . The computer apparatus of claim 1 , wherein the one or more parameters comprises a temperature, an I/O utilization rate, and a memory utilization rate.
5 . A computer implemented method comprising:
continuously receiving one or more parameter values, each corresponding to an operating parameter of a monitored processor, at least one corresponding to a task rate utilization and at least one corresponding to an energy utilization;
comparing the one or more parameter values to a corresponding threshold;
determining if the one or more parameter values exceeds the corresponding threshold;
producing a risk assessment; and
determining a weighted risk assessment based on the energy utilization and the task rate utilization.
6 . The method of claim 5 , further comprising measuring energy utilization on more than one power rail.
7 . The method of claim 5 , further comprising executing a remedial action when the risk assessment exceeds a threshold.
8 . A system comprising:
a monitored processor; and
at least one monitoring processor configured to:
continuously receive one or more parameter values, each corresponding to an operating parameter of the monitored processor, at least one corresponding to a task rate utilization and at least one corresponding to an energy utilization;
compare the one or more parameter values to a corresponding threshold;
determine if the one or more parameter values exceeds the corresponding threshold;
produce a risk assessment; and
determine a weighted risk assessment based on the energy utilization and the task rate utilization.
9 . The system of claim 8 , wherein the system further comprises an energy measurement integrated circuit configured to measure energy utilization on more than one power rail.
10 . The system of claim 8 , wherein the at least one monitoring processor is further configured to execute a remedial action when the risk assessment exceeds a threshold.
11 . The system of claim 8 , wherein the one or more parameters comprises a temperature, an I/O utilization rate, and a memory utilization rate.