Abstract: Apparatuses, systems, and techniques of using one or more circuits (e.g., of a network interface) to obtain contents of at least one memory region usable, by one or more processes being performed by a host computing system, to store dynamic memory allocations, and determine whether any of the process(es) is performing at least one potentially harmful task based at least in part on the contents of the memory region(s).

Abstract: Apparatuses, systems, and techniques of using one or more circuits (e.g., of a network interface) to obtain assembly code for one or more machine code segments loaded and/or injected into a process, and determine whether the assembly code is likely to perform at least one unauthorized task.

Abstract: Apparatuses, systems, and techniques for classifying a candidate uniform resource locator (URL) as malicious using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being words in a candidate URL and numeric features of a URL structure of the candidate URL. The security service classifies, using the ML detection system, the candidate URL as malicious or benign using the set of features. The security service outputs an indication of a malicious URL responsive to the candidate URL being classified as malicious.

Abstract: Apparatuses, systems, and techniques for classifying one or more candidate uniform resource locators (URLs) as having a domain generation algorithm (DGA) domain using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being domain characters in one or more candidate URLs. The security service classifies, using the ML detection system, the one or more candidate URLs as having a DGA domain or a non-DGA domain using the set of features. The security service outputs an indication of a DGA malware responsive to the one or more candidate URLs being classified as having the DGA domain.

Abstract: Apparatuses, systems, and techniques for detecting that one or more computer programs executed by a host device are subject to malicious activity using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being associated with the one or more computer programs. The security service determines, using the ML detection system, whether the one or more computer programs are subject to malicious activity based on the set of features. The security service outputs an indication of the malicious activity responsive to a determination that the one or more computer programs are subject to the malicious activity.

Abstract: Apparatuses, systems, and techniques for classifying one or more computer programs executed by a host device as being ransomware using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service obtains a series of snapshots of data stored in the physical memory and extracts a set of features from each snapshot of the series of snapshots, each snapshot representing the data at a point in time. The security service classifies a process of the one or more computer programs as ransomware or non-ransomware using the set of features and outputs an indication of ransomware responsive to the process being classified as ransomware.