Abstract: A processor arrangement, comprising a processor under observation, hereinafter PUO, having a processing unit, which is configured to execute an application program code stored in a memory and to provide application output data via an output interface; an observation unit that is connected to the processing unit and configured to monitor execution of the application program code by the processing unit and to provide execution information indicative of an execution pattern associated with the execution of the application program code by the PUO; a cybersecurity-monitoring engine for observing the PUO, which is inaccessible by the PUO and comprises an observation input interface for receiving the execution information and an execution-monitoring unit, which is configured to perform a comparison between the received execution information and pre-generated execution pattern information and to detect an execution anomaly in the retrieved execution information, and to provide a monitoring output signal indicative of

Abstract: A trace-data-processing device for reconstructing an execution flow of a program performed by a source device under test or under observation, herein DUT, using at least one source-specific trace-data stream is disclosed. The trace-data-processing device comprises a trace-data-processing unit, which is configured to identify in the trace-data stream at least one instruction-synchronization message and branch messages. Moreover, the trace-data-processing device is configured to generate runtime-information data indicative of an at least partial reconstruction of the execution flow, using the identified trace messages, a pre-defined branch identifier allocated to each branch instruction address in the program that is associated with a direct branch instruction and pre-stored reconstruction information stored in a reconstruction memory.

Abstract: An event-processing unit for processing tokens associated with a state or state transition, herein also referred to as an event, of an external device is disclosed. The EPU allows token-processing schemes, in which the processing of incoming tokens and the further handling of a processing result by the EPU are determined not only by the token identifier, but also by the payload data of the incoming token or by data in the data memory. A flag-processing capability of a processing-control stage allows applying flag-processing operations such as logical operations to data obtained as a processing result of an ALU-processing operation. The result of these operations determines a subsequent handling of ALU-result data by the EPU. Thus, whether or not the ALU-result data is written to the data memory also influences the processing of any subsequent incoming tokens for which that data is used in the ALU-processing operation.