Malicious activity detection of a processing thread

摘要

A mechanism is provided for detecting malicious activity in a functional unit. For a current activity value associated with a functional unit, a determination is made as to whether a thermal level associated with the functional unit differs from a verified thermal level beyond a first predetermined threshold. Responsive to the thermal level associated with the functional unit differing from the verified thermal level beyond the first predetermined threshold, a determination is made as to whether there is a known profile of thread activity levels that substantially matches current thread activity levels. Responsive to identifying the known profile that substantially matches the current thread activity levels, thread activity levels are compared to the known profile of thread activity levels. Responsive to the thread activity levels differing from the known profile beyond a second predetermined threshold, an indication of suspected abnormal activity associated with the given functional unit is sent.

主权项

1. A computer program product comprising a non-transitory computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:
monitor a set of activity values associated with a set of functional units; monitor a set of thermal levels associated with the set of functional units; for a current activity value associated with the functional unit in the set of functional units, determine whether a thermal level associated with the functional unit differs from a verified thermal level for the functional unit beyond a first predetermined threshold, wherein the verified thermal level for the functional unit and a known profile of thread activity levels are identified from a covariance matrix that associates activity values of the functional unit with verified thermal levels for the functional unit; responsive to the thermal level associated with the functional unit differing from the verified thermal level for the functional unit beyond the first predetermined threshold, determine whether there is the known profile of thread activity levels that substantially matches current thread activity levels for the functional unit; responsive to identifying the known profile of thread activity levels that substantially matches the current thread activity levels for the functional unit, compare thread activity levels for the functional unit to the known profile of thread activity levels; and responsive to the thread activity levels for the functional unit differing from the known profile of thread activity levels beyond a second predetermined threshold, send an indication of suspected abnormal activity associated with the given functional unit.