Profiling exploits with performance monitoring events
5
DEMO
6
Classification Pipeline
7
Which PMU Events?
8
Information Gain is the key
9
Sample Telemetry
10
Identifying Relevant Events
11
Feature Map Example
12
Training pipeline
13
Detection Environments
14
What else can we use from the CPU
15
Signature Detection
16
HW-based Anomaly Detection
17
What is Control Flow?
18
How does it work?
19
HW Telemetries for Control Flow Tracing
20
Training and detection phases
Description:
Explore advanced techniques for detecting malware and exploits using hardware telemetry and machine learning in this 50-minute RSA Conference talk. Delve into the details of building scalable, deployable runtime threat and anomaly detection solutions leveraging CPU telemetry. Learn about telemetry sources, feature selection, overhead management, and platform-specific design considerations. Gain insights into profiling exploits with performance monitoring events, classification pipelines, and identifying relevant events through information gain. Examine sample telemetry, feature mapping, and training pipelines for various detection environments. Discover additional CPU-based techniques, including signature detection and hardware-based anomaly detection using control flow tracing. Understand the evolution of malware detection technologies and how CPU telemetry can reveal even the most concealed malicious code at an instruction level.
Nowhere to Hide - How HW Telemetry and ML Can Make Life Tough for Exploits