Abstract: A performance monitoring unit of a processor includes one or more performance monitoring counters, and a behavioral detector to sample data from a set of the one or more performance monitoring counters, analyze the sampled data, and identify a type of workload of a software process being executed by the processor.

Abstract: A method comprises generating a first set of hardware performance counter (HPC) events that is ranked based on an ability of an individual HPC event to profile a malware class, generating a second set of HPC event combinations that is ranked based on an ability of a set of at least two joint HPC events to profile a malware class, generating a third set of extended HPC event combinations, profiling one or more malware events and one or more benign applications to obtain a detection accuracy parameter for each malware event, applying a machine learning model to rank the third set of HPC event combinations based on malware detection accuracy, and applying a genetic algorithm to the third set of HPC event combinations to identify a subset of the third set of extended combinations of HPC events to be used for malware detection and classification.

Abstract: The present disclosure is directed to systems and methods for detecting side-channel exploit attacks such as Spectre and Meltdown. Performance monitoring circuitry includes first counter circuitry to monitor CPU cache misses and second counter circuitry to monitor DTLB load misses. Upon detecting an excessive number of cache misses and/or load misses, the performance monitoring circuitry transfers the first and second counter circuitry data to control circuitry. The control circuitry determines a CPU cache miss to DTLB load miss ratio for each of a plurality of temporal intervals. The control circuitry the identifies, determines, and/or detects a pattern or trend in the CPU cache miss to DTLB load miss ratio. Upon detecting a deviation from the identified CPU cache miss to DTLB load miss ratio pattern or trend indicative of a potential side-channel exploit attack, the control circuitry generates an output to alert a system user or system administrator.

Abstract: The present disclosure is directed to systems and methods for detecting side-channel exploit attacks such as Spectre and Meltdown. Performance monitoring circuitry includes first counter circuitry to monitor CPU cache misses and second counter circuitry to monitor DTLB load misses. Upon detecting an excessive number of cache misses and/or load misses, the performance monitoring circuitry transfers the first and second counter circuitry data to control circuitry. The control circuitry determines a CPU cache miss to DTLB load miss ratio for each of a plurality of temporal intervals. The control circuitry the identifies, determines, and/or detects a pattern or trend in the CPU cache miss to DTLB load miss ratio. Upon detecting a deviation from the identified CPU cache miss to DTLB load miss ratio pattern or trend indicative of a potential side-channel exploit attack, the control circuitry generates an output to alert a system user or system administrator.

Abstract: A secure performance monitoring unit of a processor includes one or more performance monitoring counters and a secure group manager. The secure group manager is configured to receive a request to create a secure counter group from a software (SW) process being executed by a processor, the request including identification of the one or more counters; determine availability of the one or more counters, creating the secure counter group, assign the one or more counters to the secure counter group, and save a public key of the SW process, when the one or more counters are available; receive and save a private key for the secure counter group; receive a request to configure the secure counter group from the SW process; verify the configuration using the public key of the SW process; and begin sampling of the one or more counters when the configuration is verified.

Abstract: A processor includes one or more processing cores, and a performance monitoring unit (PMU), the PMU including one or more performance monitoring counters; a PMU memory to store a PMU kernel, the PMU kernel including one or more programmable PMU functions; and a PMU processor to load the PMU kernel and concurrently execute the one or more programmable PMU functions of the PMU kernel to concurrently access the one or more performance counters.

Abstract: A system includes a processor to execute a data flow instrumented application to generate data trace data representing data flows of the data flow instrumented application; processor trace circuitry to generate processor trace (PT) data from the data trace data; and a data flow detecting pipeline to monitor the data flows represented by the PT data in real time and generate an alert if one or more of the data flows deviates from a data flow model for the data flow instrumented application.

Abstract: A performance monitoring unit of a processor includes one or more performance monitoring counters, and a behavioral detector to sample data from a set of the one or more performance monitoring counters, analyze the sampled data, and identify a type of workload of a software process being executed by the processor.

Abstract: A method comprises generating a first set of hardware performance counter (HPC) events that is ranked based on an ability of an individual HPC event to profile a malware class, generating a second set of HPC event combinations that is ranked based on an ability of a set of at least two joint HPC events to profile a malware class, generating a third set of extended HPC event combinations, profiling one or more malware events and one or more benign applications to obtain a detection accuracy parameter for each malware event, applying a machine learning model to rank the third set of HPC event combinations based on malware detection accuracy, and applying a genetic algorithm to the third set of HPC event combinations to identify a subset of the third set of extended combinations of HPC events to be used for malware detection and classification.

Abstract: A user authentication system and method. A two-dimensional image of a scene is obtained and range information obtained from the scene is aligned with the two-dimensional image. One or more depth regions is identified and image segments corresponding to the one or more depth regions are selected within the two-dimensional image. Brightness operations are performed on one or more of the selected image segments to form a corrected image.

Abstract: Embodiments described herein provide an apparatus comprising a processor to receive, from a gaming/anti-cheating server, a message comprising a first pixel data set comprising first pixel data for one or more pixels of a watermark generated by the gaming/anti-cheating server, store the first pixel data set in the machine-readable memory, receive, from a gaming system, a frame buffer rendered by the gaming system and comprising the watermark generated by the gaming/anti-cheating server, isolate, from the frame buffer, a second pixel data set comprising second pixel data for one or more pixels corresponding to the first pixel set, and forward an alert to the gaming/anti-cheating server when the second pixel data differs from the first pixel data by an amount that exceeds a threshold. Other embodiments may be described and claimed.

Abstract: Embodiments described herein provide an apparatus comprising a processor to receive, from a gaming/anti-cheating server, a message comprising a first pixel data set comprising first pixel data for one or more pixels of a watermark generated by the gaming/anti-cheating server, store the first pixel data set in the machine-readable memory, receive, from a gaming system, a frame buffer rendered by the gaming system and comprising the watermark generated by the gaming/anti-cheating server, isolate, from the frame buffer, a second pixel data set comprising second pixel data for one or more pixels corresponding to the first pixel set, and forward an alert to the gaming/anti-cheating server when the second pixel data differs from the first pixel data by an amount that exceeds a threshold. Other embodiments may be described and claimed.

Abstract: System and techniques for spoofing detection in image biometrics are described herein. A sequence of images may be obtained from a camera; a first plurality of images in the sequence of images including a representation of a user body part, and a second plurality of images in the sequence of images including a representation of an environment of the user. A marker may be created for the representation of the body part. A feature of the environment of the user present during the second plurality of images may be identified in the sequence of images using a third group of circuits. A correlation between the marker and the feature of the environment in the sequence of images may be quantified to produce a synchronicity metric of the degree to which the marker and the feature of the environment correlate.

Abstract: The present disclosure is directed to systems and methods for detecting side-channel exploit attacks such as Spectre and Meltdown. Performance monitoring circuitry includes first counter circuitry to monitor CPU cache misses and second counter circuitry to monitor DTLB load misses. Upon detecting an excessive number of cache misses and/or load misses, the performance monitoring circuitry transfers the first and second counter circuitry data to control circuitry. The control circuitry determines a CPU cache miss to DTLB load miss ratio for each of a plurality of temporal intervals. The control circuitry the identifies, determines, and/or detects a pattern or trend in the CPU cache miss to DTLB load miss ratio. Upon detecting a deviation from the identified CPU cache miss to DTLB load miss ratio pattern or trend indicative of a potential side-channel exploit attack, the control circuitry generates an output to alert a system user or system administrator.

Abstract: System and techniques for preventing face-based authentication spoofing are described herein. A visible light emitter may be controlled to project a pattern into a camera's field of view during an authentication attempt. An image may be obtained from the camera for the authentication attempt. A potential spoofing region on image may be identified by finding the pattern. An authentication attempt based on a face found in the potential spoofing region may be prevented.

Abstract: System and techniques for spoofing detection in image biometrics are described herein. A sequence of images may be obtained from a camera; a first plurality of images in the sequence of images including a representation of a user body part, and a second plurality of images in the sequence of images including a representation of an environment of the user. A marker may be created for the representation of the body part. A feature of the environment of the user present during the second plurality of images may be identified in the sequence of images using a third group of circuits. A correlation between the marker and the feature of the environment in the sequence of images may be quantified to produce a synchronicity metric of the degree to which the marker and the feature of the environment correlate.

Abstract: System and techniques for spoofing detection in image biometrics are described herein. A sequence of images may be obtained from a camera; a first plurality of images in the sequence of images including a representation of a user body part, and a second plurality of images in the sequence of images including a representation of an environment of the user. A marker may be created for the representation of the body part. A feature of the environment of the user present during the second plurality of images may be identified in the sequence of images using a third group of circuits. A correlation between the marker and the feature of the environment in the sequence of images may be quantified to produce a synchronicity metric of the degree to which the marker and the feature of the environment correlate.

Abstract: A system and method for capturing an image of a user. An image is captured with a camera, wherein the image includes a user's image. A first avatar is displayed in a display, wherein displaying includes positioning an avatar in at least some of the user's image. The user is then encouraged to move so the first avatar moves to a second position in the display.